Executive brief
cowork_bench is a multi-tool LLM agent benchmark that includes a pdf-tools component for processing PDF files. An attacker with access to the MCP interface can manipulate PDF file paths to make the server send requests to internal services, cloud metadata endpoints, or other restricted destinations that should not be accessible, potentially exposing sensitive data or enabling further attacks on internal infrastructure.
Technical details
A server-side request forgery (CWE-918) exists in the get_pdf_info MCP tool of pdf-tools-mcp 0.1.4 bundled with cowork_bench. The vulnerable code in server.py accepts an attacker-controlled pdf_file_path argument, passes it through resolve_path and download_pdf_from_url to requests.get() with allow_redirects=True, without validating the destination host, port, or redirect targets. An attacker with MCP interface access can craft URLs or HTTP 302 redirects to arbitrary internal services; the post-request PDF format validation does not prevent exploitation.
Affected products
- 0717376 cowork_bench up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d
Timeline
- 2026-09-20: disclosed: Public disclosure via CVE-2026-94051
- 2026-09-20: other: Exploit proof-of-concept published; vendor not yet responsive to early notification