The Pulse
Mohiuddin Finds MCP Security Bugs Across Five Organizations
Independent researcher Syed Anas Mohiuddin says security teams at Google, JPMorgan Chase, Weaviate, France’s DINUM and Indonesia’s Tangerang City fixed MCP-related server-side request forgery bugs. He distinguishes those confirmed fixes fro
AI.info Team · Written with AI ·
“Both come from the same assumption. The developer treats data crossing the MCP boundary, in either direction, as trusted because it came from inside the system.”
Syed Anas Mohiuddin, independent security researcher
In an update published in October, independent security researcher Syed Anas Mohiuddin says five organizations confirmed and fixed server-side request forgery (SSRF) bugs in Model Context Protocol (MCP) servers. The organizations were Google, JPMorgan Chase, Weaviate, France’s interministerial digital directorate, and the government of Tangerang City, Indonesia. His account describes a recurring implementation problem: MCP server inputs that can influence requests or other actions are not always checked as untrusted data.
The findings give context to an Ars Technica report published October 5, 2026, about malicious instructions moving between agents. Mohiuddin calls that kind of cross-protocol attack “protocol pivoting”: an attacker gets an instruction into one part of a system, then exploits trust between agents or protocols to reach capabilities available elsewhere. His write-up presents the confirmed server bugs as evidence of a broader risk, not as proof that every listed organization suffered the same prompt-injection exploit.
Five confirmed SSRF fixes—and separate open reports
SSRF occurs when a server makes a network request to a destination chosen or influenced by an input it failed to validate. In an agent workflow, that input can arrive as a tool argument selected after the agent reads outside content. If the server accepts a supplied URL, endpoint or path without checking the destination, the request can originate from inside the server’s network boundary.
Mohiuddin says Google’s MCP Toolbox for Databases could follow a redirect to an internal endpoint because its HTTP client lacked redirect controls and did not validate target IP addresses. Google assigned the issue CVE-2026-14540 with a CVSS score of 8.0, according to his account. He describes a fix that checks resolved addresses and applies IP-range allow and block lists.
JPMorgan Chase’s documentation-search server had an unrestricted URL fetch in one tool, while Weaviate’s Google module accepted configurable endpoint values. Mohiuddin also describes an SSRF issue in France’s official open-data MCP server and another in a Wazuh MCP server maintained by Tangerang City. He says each organization confirmed and fixed its finding.
Those cases differ from Rapid7’s CVE-2026-97228, which involved unsafe interpolation of an export identifier into a GraphQL query. Rapid7’s record rates it 2.7 and says version 0.6.2 fixes the issue by using a parameterized query. Mohiuddin calls it related evidence of insufficient validation across an MCP boundary, but it is not one of the five SSRF cases.
What the findings do—and don’t—establish
Mohiuddin lists five reports involving U.S. federal MCP servers as still in triage, not confirmed outcomes. His write-up says those reports concern a separate failure mode: upstream API response data written to logs without redaction. He also cautions that he is not presenting those reports as resolved or validated findings.
Security researcher Markus Vervier, quoted by Ars Technica, disputes whether “protocol pivoting” needs to be treated as a distinct attack class, describing it instead as indirect prompt injection. The terminology differs, but the practical concern is the same: a downstream agent may act on instructions relayed by a system it trusts, while a vulnerable server supplies access to network resources or other capabilities.
Trust has to be checked at each handoff
Mohiuddin’s account points to a gap between agent delegation and the security checks traditionally applied to individual services. A downstream agent may treat a request from an upstream agent as legitimate; an MCP server may then act on the resulting tool input using its own network access. Checking only the model’s initial prompt or scanning software dependencies can miss unsafe handling at those boundaries.
The strongest evidence in the update is specific: five organizations confirmed and fixed SSRF issues, Rapid7 published a separate low-severity vulnerability, and five U.S. federal reports remained under review. That record supports scrutiny of how MCP servers validate inputs and restrict outbound requests. It does not establish that every agent chain is vulnerable or that the still-open federal reports have been confirmed.