I found an SSRF in Google's official AI tooling, and how Google reacted
A server-side request forgery (SSRF) vulnerability was discovered in Google's MCP Toolbox, where HTTP redirects to internal/cloud metadata endpoints (e.g., 169.254.169.254) were followed without validation, exposing cloud credentials. The bug was reported with a reproduction and fix suggestion; Google merged a fix in 8 days via PR #3448, introducing an SSRFGuard that validates every redirect hop, blocks private/link-local ranges (including IPv6-encoded IPv4), resists DNS rebinding, and fails fas
Analysis
TL;DR
- A server-side request forgery (SSRF) vulnerability was discovered in Google's MCP Toolbox, where HTTP redirects to internal/cloud metadata endpoints (e.g., 169.254.169.254) were followed without validation, exposing cloud credentials.
- The bug was reported with a reproduction and fix suggestion; Google merged a fix in 8 days via PR #3448, introducing an SSRFGuard that validates every redirect hop, blocks private/link-local ranges (including IPv6-encoded IPv4), resists DNS rebinding, and fails fast on misconfiguration.
- The vulnerability was assigned CVE-2026-14540 with a CVSS score of 8.0 (high), and the reporter is officially credited in the CVE record.
- The author is auditing other official MCP servers for the same pattern and plans to publish findings privately first, with public write-ups following after fixes are deployed.
Why It Matters
This vulnerability highlights a critical class of SSRF risks specific to AI agent tooling, where caller-influenced URLs are the norm rather than an edge case—making exploitation far more likely than in traditional software. It also demonstrates that responsible disclosure can yield rapid, well-implemented fixes from major tech companies, reinforcing the value of coordinated vulnerability reporting in the AI ecosystem.
Technical Details
- Vulnerability class: Server-Side Request Forgery (SSRF) via unvalidated HTTP redirects in the MCP Toolbox's HTTP source, allowing redirection to internal cloud metadata endpoints (169.254.169.254) to exfiltrate environment credentials.
- Root cause: The toolbox validated only the initial caller-supplied URL but did not validate redirect destinations or filter private/link-local IP ranges, including IPv6-mapped IPv4 addresses.
- Fix (PR #3448): Introduced an
SSRFGuardthat validates the destination on every redirect hop, blocks private and link-local ranges (including IPv6 forms encoding IPv4), resists DNS rebinding attacks, enforces configurable network boundaries, and performs early base-URL validation at initialization time. - Severity: CVE-2026-14540, CVSS 8.0 (High).
- Scope: The author is auditing other official MCP servers for the same redirect-validation gap; some are correctly pinned, others are not.
Industry Insight
- AI agent frameworks that make outbound HTTP requests on behalf of users must treat caller-influenced destinations as a default threat model, not an edge case—SSRF mitigations should be enforced at every hop, not just the initial request.
- The 8-day fix turnaround from report to merge sets a strong benchmark for responsible disclosure; organizations building tool-calling infrastructure should proactively adopt SSRF guards and network-boundary enforcement before vulnerabilities are discovered externally.
- The existence of similar gaps across other MCP servers suggests a systemic pattern in agent tooling; the community would benefit from a shared security checklist or reference implementation for safe HTTP source handling in agent frameworks.
Disclaimer: The above content is generated by AI and is for reference only.