An unauthenticated server-side request forgery (SSRF) vulnerability in dmitryglhf mcp-url-downloader allows remote attackers to access internal network resources.

The application incorrectly validates URLs by only checking the initial request target, failing to re-verify the destination after following HTTP redirects. An unauthenticated attacker can exploit this by providing a malicious URL that redirects to internal endpoints, such as cloud metadata services or local administrative interfaces.

Successful exploitation allows an attacker to bypass network perimeters and exfiltrate sensitive data from internal services or cloud environments. Given the CVSS score of 7.3, this represents a significant risk to organizational confidentiality, particularly in cloud-hosted deployments where metadata services could be compromised.

Immediate Action: As no official patch is currently available, users should restrict access to the MCP server to trusted users only and disable the affected tool if it is not business-critical.

Proactive Monitoring: Review access logs for suspicious tool invocations involving external URLs that may be intended to probe internal infrastructure or cloud metadata services.

Compensating Controls: Implement network-level egress filtering on the host running the MCP server to prevent connections to internal IP ranges, RFC1918 addresses, and the cloud link-local address 169.254.169.254.

Public Exploit Available: Yes — a technical proof-of-concept is documented in the referenced GitHub issue.

Organizations using mcp-url-downloader must treat this vulnerability with high priority due to the ease of exploitation and potential for internal data exposure. Until a vendor-supplied patch is released, administrators should implement strict network egress controls to isolate the server from internal resources.