An unauthenticated server-side request forgery vulnerability in TencentCloudBase CloudBase-MCP allows remote attackers to force the server to perform unauthorized outbound requests.

The vulnerability resides in the openUrl function within mcp/src/interactive-server.ts. An unauthenticated attacker can supply a malicious URL via the req.body.url parameter to the /api/open-url endpoint, which the application then processes without validation, resulting in SSRF.

Successful exploitation allows an attacker to coerce the server into making arbitrary outbound network requests. This can be leveraged to scan internal infrastructure, access sensitive metadata services, or interact with private network resources that are otherwise unreachable from the public internet. Given the CVSS score of 7.3, this flaw poses a significant risk to internal network segmentation and data confidentiality.

Immediate Action: Upgrade to TencentCloudBase CloudBase-MCP version 2.17.1 or later, which includes the necessary input validation to remediate the SSRF vulnerability.

Proactive Monitoring: Review access logs for any suspicious POST requests directed at the /api/open-url endpoint, particularly those containing internal IP addresses or unexpected domains.

Compensating Controls: Ensure the interactive server is not exposed to untrusted networks. Configure the environment variable INTERACTIVE_SERVER_HOST to 127.0.0.1 to restrict access to the local loopback interface if remote access is not required.

Public Exploit Available: Yes — a proof-of-concept for this vulnerability is documented in the researcher's report linked via the project's GitHub issue tracker.

The presence of a public proof-of-concept and the ease of triggering this SSRF via an unauthenticated endpoint make this a high-priority remediation task. Administrators should prioritize upgrading to version 2.17.1 immediately. In environments where an immediate update is not feasible, ensure the service is bound strictly to the local loopback interface and restricted by network-level access controls to prevent unauthorized interaction with the vulnerable API endpoint.