SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Same SSRF flaw found in MCP servers from Google, Anthropic, Microsoft, and Weaviate

0
·1 views

A security researcher discovered an identical Server-Side Request Forgery (SSRF) vulnerability in Model Context Protocol servers independently built by four major vendors — Google, Anthropic, Microsoft, and Weaviate — over the first nine months of 2026. The shared flaw stemmed from a common false assumption: that a URL configured or supplied by an operator was inherently trustworthy, leaving model-supplied URLs unvalidated against internal IP ranges, loopback addresses, and redirect chains. Because MCP servers act on structured input from language models, any attacker who can influence what a model reads — via a prompt-injected webpage, document, or database row — can effectively control the server's outbound requests. Google's fix was merged in June 2026 and released as MCP Toolbox v1.5.0, with the issue assigned CVE-2026-14540 at CVSS 8.0 High. The pattern across four separate codebases, languages, and review cultures suggests the vulnerability reflects a systemic industry-wide misconception about trust boundaries in AI-integrated server architectures.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Wpipe offers embedded Python pipeline orchestration without infrastructure overhead

Wpipe is an open-source Python library designed to run data and processing pipelines without requiring dedicated orchestration servers, external databases, or cloud APIs. Unlike platforms such as Prefect, wpipe operates as a fully self-contained, zero-config engine embedded directly within application code. It uses a local SQLite WAL database for atomic state persistence, eliminating network latency and external dependencies. The library supports transactional checkpointing, making it suited for edge computing and tactical data engineering use cases. Wpipe is available on GitHub and PyPI for developers seeking lightweight pipeline control in pure Python.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Wpipe Offers Embedded Python Pipeline Orchestration With No Server Required

Wpipe is an open-source Python library designed to run data and processing pipelines without the need for dedicated orchestration servers, external databases, or cloud APIs. Unlike tools such as Prefect, wpipe operates as a self-contained, importable module that stores all state and execution tracking in a local SQLite file using WAL mode. The library supports atomic checkpointing, meaning pipelines can resume from the last successful step even after unexpected hardware failures or power loss. It is particularly suited for edge computing environments, IoT devices, Raspberry Pi deployments, and CI/CD pipelines where network connectivity and system resources may be limited. Wpipe is available on both GitHub and PyPI for developers seeking lightweight, infrastructure-free workflow orchestration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Living City Platform Uses AI Memory Layer to Give Hyderabad a Urban Intelligence System

A developer has built 'Living City,' an AI-powered urban intelligence platform focused on Hyderabad that goes beyond traditional real-time dashboards. The platform's core innovation is a persistent memory layer called Hindsight, which stores meaningful past city events — such as how heavy rain led to waterlogging and transit delays — rather than raw data. When a new urban event occurs, the AI queries Hindsight to retrieve relevant past experiences and uses them as context for its current analysis. This creates a continuous intelligence loop described as Observe, Remember, Recall, Reason, Learn, and Remember again. The goal is to shift city monitoring from simply reporting what is happening now to understanding it in light of what has happened before.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

18-Year-Old Developer Builds Cookie-Free Funnel Analytics Tool Cloudline

Om Yaduvanshi, an 18-year-old applied AI developer, has built Cloudline, a cookieless alternative to Google Analytics that tracks user funnels without storing cookies or IP addresses. The tool uses a single script tag under 2 KB and records only page, referrer, screen size, and time for each pageview. Instead of following individual users across sessions, Cloudline stacks anonymous counts — pageviews and button clicks — in a developer-defined sequence to reveal where visitors drop off. The approach carries one acknowledged limitation: it assumes users who clicked a button were among those who viewed the preceding page, which may not always hold true. Cloudline is currently free for early users while the product remains in active development.

0 comments Read more at DEV Community