Google, JPMorgan, Weaviate and two governments shipped the same SSRF flaw in their MCP servers
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
The Product Desk
What happened
- Mohiuddin argued in May that the flaw was structural and predicted that teams sharing no code or owner would each end up producing it.
- Google's instance, CVE-2026-14540 in MCP Toolbox for Databases, is rated high at 8.0 and affects versions 0.3.0 through 1.4.0.
- France's DINUM ran an official MCP server for its open-data platform that fetched producer-supplied URLs able to point at internal or cloud metadata addresses.
- Five MCP servers under the US General Services Administration's Technology Transformation Services, reported on 2 September, are still in triage and unfixed.
Why it matters
- Who has to decide decision The five teams share no code, so no single upstream patch will close this class of bug, and every team running MCP tool servers has to find its own outbound fetch paths.
- Who's exposed exposure Until the GSA servers are patched, the Veterans Affairs claims server's unredacted error logs can hold a veteran's name, Social Security number, date of birth and address, according to Mohiuddin.
- What it limits constraint Forking a reviewed MCP component keeps its safety only until someone adds a feature, so a review of the upstream project tells a team nothing about what its own fork now fetches.
Next story · Product · Oct 8
AI terms draw the most rival bids in ICANN's 1,615-application domain roundConfirmed4 publishers
JPMorgan's open-source documentation-search MCP server had two tools that fetch content. One checked domains against an allowlist. The other fetched any URL the caller supplied, Mohiuddin wrote [17]. JPMorgan had forked the component from an AWS project that never fetched the caller's URL at all. Its Responsible Disclosure team confirmed the finding and deployed a fix, according to Mohiuddin [18].
The caller in that case is whoever steers the agent. The server sends its request wherever that party points it, internal systems included [3]. That party does not have to be the agent's user. In the attack Mohiuddin calls protocol pivoting, someone plants text shaped like a task for Google's A2A protocol inside content an MCP tool returns. An orchestrating agent passes it to a subagent, which runs it because it trusts the orchestrator [6]. Ars Technica reported that MCP servers store credentials for each agent and that agents are built to trust every other internal agent [10].
"Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch," Douglas McKee, Rapid7's director of vulnerability intelligence, told Ars Technica [7]. Markus Vervier of X41 D-Sec told the same outlet that the technique is a form of indirect prompt injection [11].
In Tangerang's Wazuh MCP server, a tool advertised SSRF protection. In practice it rejected literal IP addresses and never resolved hostnames, according to a high-severity advisory published on 3 September [21]. That makes two of the five fixed servers where a destination check already existed and missed the request that mattered [25].
"Watching the same mistake come back from a hyperscaler, a bank, and a national government, one report at a time, is the moment the May argument stopped being a guess," Mohiuddin wrote [13]. The evidence is one researcher's reports. They show the same flaw at organisations with, in Ars Technica's words, "little in common except for their use of AI agents" [8]. They do not measure how many MCP servers have it.
The two outlets also count differently. TNW's list of five SSRF fixes leaves out Rapid7. Rapid7's bug, CVE-2026-97228, was a GraphQL injection within the operator's own access, and Rapid7 rates it low, at 2.7 [22]. Ars Technica described Google and four other organisations acknowledging flaws that spread instructions from one internal agent to others. It named Rapid7 and the US federal government among the organisations whose agents Mohiuddin tested [8][9].
A team running its own tool servers can sort each fetch path on two axes. The first is who supplies the destination: fixed configuration, or the agent, caller or data source at call time. The second is where the check runs: on the address text, or on the address the request actually reaches after DNS lookup and redirects. A tool with a fixed destination is outside this flaw, which needs an address taken from the agent [3]. The risky quadrant is a destination supplied at call time and checked only as text, or not checked at all. Google's toolbox sat there, with no restrictive redirect policy and no check on target IP addresses [14].
The fixes on record take two shapes. Weaviate restricted its Google module's endpoint settings to Google API hosts [19]. Google added a guard against DNS rebinding plus lists of allowed and blocked IP ranges [16]. I'd start with an allowlist wherever a tool only needs a handful of known hosts, and accept that the tool will then refuse everything else. A general-purpose fetch tool needs Google's approach. That means resolving the hostname and checking the resulting address, the step Tangerang's tool skipped [21].
What to watch
- Whether GSA's Technology Transformation Services patches the five servers, after which Mohiuddin says he will publish code-level detail.
- Mohiuddin's presentation of the findings at MCPCon North America in San Jose on 23 October.
- Whether Japan's Digital Agency fixes its grants server, which Mohiuddin reported as having no authentication.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption48
- Hype gap+22
- Incentives40
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security teams at Google, JPMorgan Chase, Weaviate, France's interministerial digital directorate (DINUM) and the city government of Tangerang in Indonesia each fixed the same type of flaw in their MCP servers; independent researcher Syed Anas Mohiuddin reported all five.
- [2]
MCP is the standard AI agents use to call tools and data sources.
- [3]
The flaw is server-side request forgery: an MCP server takes a URL, path or endpoint from an agent and builds an outbound request from it without checking where the address actually resolves, letting whoever steers the agent decide what the server talks to, including internal systems.
- [4]
On 2 September Mohiuddin privately reported issues in five MCP servers under the US General Services Administration's Technology Transformation Services, including servers for Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending and CDC PLACES; all five are still in triage and not fixed.
- [5]
The Veterans Affairs server logs full error responses from the benefits API without redaction, which can contain a veteran's name, Social Security number, date of birth and address; Mohiuddin is withholding code-level detail until maintainers patch the servers.
- [6]
In what Mohiuddin calls protocol pivoting, an attacker plants text shaped like a task for Google's A2A protocol in content an MCP tool returns; an orchestrating agent passes it to a subagent, which runs it because it trusts the orchestrator.
- [7]
"Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch," Douglas McKee, Rapid7's director of vulnerability intelligence, told Ars Technica.
- [8]
In the past five months, Google and four other organisations, with "little in common except for their use of AI agents", acknowledged vulnerabilities that exploit one agent inside a targeted network to spread harmful instructions to other internal agents.
- [9]
Mohiuddin tested agents from organisations including Google, JP Morgan Chase, Weaviate, Rapid7, the French government's interministerial digital directorate and the US federal government.
- [10]
MCP servers store credentials for each agent and agents are built to trust every other internal agent; in many cases well-crafted prompts targeting the right agent lead to server-side request forgery.
- [11]
Markus Vervier of X41 D-Sec told Ars Technica that the technique is a form of indirect prompt injection.
- [12]
In May, Mohiuddin argued the problem was structural and predicted that teams sharing no code or owner would all produce it.
- [13]
"Watching the same mistake come back from a hyperscaler, a bank, and a national government, one report at a time, is the moment the May argument stopped being a guess," Mohiuddin wrote.
- [14]
Google's MCP Toolbox for Databases had an HTTP client with no restrictive redirect policy and no check on target IP addresses; a crafted path parameter could send its requests to internal or external endpoints.
- [15]
Google's flaw, CVE-2026-14540, carries a high rating of 8.0 and affects versions 0.3.0 to 1.4.0 of MCP Toolbox for Databases.
- [16]
Google's fix adds a guard against DNS rebinding and lists of allowed and blocked IP ranges, and credits Mohiuddin.
- [17]
JPMorgan's open-source documentation-search MCP server had two tools that fetch content; one checked domains against an allowlist, while its sibling fetched any URL the caller supplied.
- [18]
JPMorgan forked the component from an AWS project that never fetched the caller's URL at all; JPMorgan's Responsible Disclosure team confirmed the finding and deployed a fix; the finding is medium severity.
- [19]
Weaviate restricted its Google module's endpoint settings to Google API hosts.
- [20]
DINUM's official MCP server for France's open-data platform fetched URLs supplied by data producers, which could point at internal or cloud metadata addresses; its fix is titled "harden SSRF on external APIs".
- [21]
In Tangerang's Wazuh MCP server, a tool advertised SSRF protection but only rejected literal IP addresses and never resolved hostnames, according to a high-severity advisory published on 3 September.
- [22]
Rapid7 fixed a different bug Mohiuddin found, CVE-2026-97228, in its Bulk Export MCP server; it allowed GraphQL injection within the operator's own access, and Rapid7 rates it low, at 2.7.
- [23]
Mohiuddin's report on Japan's Digital Agency grants server, which had no authentication, remains open.
- [24]
Mohiuddin will present the findings at MCPCon North America in San Jose on 23 October.
- [25]
In two of the five fixed SSRF cases, JPMorgan's and Tangerang's, the server already had a destination check that did not cover the vulnerable request.
Sources
2 independent publishers whose own reporting we read for this story.
- arstechnica.comVulnerability in agents from Google and others exposes structural flaw in MCP
1 article · October 5, 2026
- thenextweb.comGoogle, JPMorgan and two governments fixed the same MCP flaw
1 article · October 5, 2026
Topics and entities
Entities
- GSA Technology Transformation Services
- Model Context Protocol
- JPMorgan Chase
- MCP Toolbox for Databases
- Syed Anas Mohiuddin
- A2A
- Rapid7
- Weaviate