谷歌、摩根大通、Weaviate、法国部委间数字理事会（DINNUM）和印度尼西亚Tangerang市政府的安全团队均修复了其模型上下文协议（HCP）服务器中的相同类型的缺陷。独立研究员赛义德·阿纳斯·莫希丁（Syed Anas Mohiuddin）在本月发布的一份更新中写道，他报告了这五项。
Security teams at Google, JPMorgan Chase, Weaviate, France’s interministerial digital directorate (DINUM) and the city government of Tangerang in Indonesia have each fixed the same type of flaw in their Model Context Protocol (MCP) servers. Independent researcher Syed Anas Mohiuddin reported all five, he wrote in an update published this month.
LCP是人工智能代理用来调用工具和数据源的标准。该缺陷是服务器端请求伪造（SSRF）。MCP服务器从代理获取URL、路径或端点，并从中构建出站请求，而不检查地址实际解析的位置。这使得任何控制代理的人都可以决定服务器与什么对话，包括内部系统。
MCP is the standard AI agents use to call tools and data sources. The flaw is server-side request forgery (SSRF). An MCP server takes a URL, path or endpoint from an agent and builds an outbound request from it, without checking where the address actually resolves. That lets whoever steers the agent decide what the server talks to, including internal systems.
今年5月，Mohiuddin认为问题是结构性的。他预测，如果是这样的话，那些没有共享代码或所有者的团队都会开发它。
In May, Mohiuddin argued that the problem was structural. If it was, he predicted, teams that share no code or owner would all produce it.
莫希丁写道：“看着同样的错误从超大规模者、银行和国家政府身上一次一份报告，五月的论点不再是猜测。”
“Watching the same mistake come back from a hyperscaler, a bank, and a national government, one report at a time, is the moment the May argument stopped being a guess,” Mohiuddin wrote.
根据GitHub的公告，谷歌的数据库中的五个修复程序有一个没有限制性重定向政策的HTTP客户端，也没有对目标IP地址进行检查。精心设计的路径参数可以将其请求发送到内部或外部端点。该缺陷BEP-2026-14540的评级高达8.0，影响0.3.0至1.4.0版本。谷歌的修复程序增加了对DNS重新绑定的防范措施以及允许和阻止的IP范围列表，并归功于Mohiuddin。
Five fixes Google’s MCP Toolbox for Databases had an HTTP client with no restrictive redirect policy and no check on target IP addresses, according to the GitHub advisory. A crafted path parameter could send its requests to internal or external endpoints. The flaw, CVE-2026-14540, carries a high rating of 8.0 and affects versions 0.3.0 to 1.4.0. Google’s fix adds a guard against DNS rebinding and lists of allowed and blocked IP ranges, and credits Mohiuddin.
摩根大通的开源存储库包括一个文档搜索HCP服务器，该服务器带有两个获取内容的工具。有人根据允许列表检查域名。莫希丁写道，它的兄弟姐妹获取了呼叫者提供的任何URL。摩根大通从AWS项目中分叉了该组件，该项目根本没有获取调用者的URL。他写道，摩根大通的负责任披露团队证实了这一发现，并部署了修复方案。他写道，这一发现的严重程度为中等。
JPMorgan’s open-source repository includes a documentation-search MCP server with two tools that fetch content. One checked domains against an allowlist. Its sibling fetched any URL the caller supplied, Mohiuddin wrote. JPMorgan forked the component from an AWS project that never fetched the caller’s URL at all. JPMorgan’s Responsible Disclosure team confirmed the finding and deployed a fix, he wrote. The finding is medium severity, he wrote.
他写道，Weaviate将其Google模块的端点设置限制为Google API主机。DINUM用于法国开放数据平台的官方HCP服务器获取了数据生产者提供的URL，这些URL可能指向内部或云元数据地址。其修复标题为“在外部API上加强SSRF”，开头为“Report by Syed Anas Mohiuddin”。
Weaviate restricted its Google module’s endpoint settings to Google API hosts, he wrote. DINUM’s official MCP server for France’s open-data platform fetched URLs supplied by data producers, which could point at internal or cloud metadata addresses. Its fix, titled “harden SSRF on external APIs”, opens with “Reported by Syed Anas Mohiuddin”.
根据9月3日发布的一份高严重性通知，在Tangerang的Wazuh HCP服务器中，一个工具宣传了SSRF保护，但只拒绝了字面IP地址。它从未解决过主机名。
In Tangerang’s Wazuh MCP server, a tool advertised SSRF protection but only rejected literal IP addresses, according to a high-severity advisory published on 3 September. It never resolved hostnames.
Rapid 7修复了他在其Bulk Exit HCP服务器中发现的另一个错误，即UTE-2026-97228。该漏洞允许操作员自己的访问权限内注入GraphQL，Rapid 7的数据库条目称，该漏洞的评分很低，为2.7。
Rapid7 fixed a different bug he found, CVE-2026-97228, in its Bulk Export MCP server. The bug allowed GraphQL injection within the operator’s own access, and Rapid7 rates it low, at 2.7, its database entry says.
仍在开放9月2日，Mohiuddin私下报告了美国总务管理局技术转型服务部下属的五台LCP服务器存在问题。其中包括退伍军人事务部福利索赔服务器、CMS Blue Button、regulations.gov、USApending和CDC PLACES。他写道，这五人仍在分诊中，尚未修复。
Still open On 2 September, Mohiuddin privately reported issues in five MCP servers under the US General Services Administration’s Technology Transformation Services. They include servers for Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending and CDC PLACES. All five are still in triage and not fixed, he wrote.
Mohiuddin表示，在退伍军人事务部的案例中，服务器会记录来自福利API的完整错误响应，而无需进行编辑。这些信息可以包含退伍军人的姓名、社会安全号码、出生日期和地址。在维护者修补服务器之前，他隐瞒了代码级的详细信息。他关于日本数字机构授权服务器的报告也仍然开放，该服务器没有经过验证。“协议旋转”Mohiuddin称更广泛的攻击类别为“协议旋转”。
In the Veterans Affairs case, the server logs full error responses from the benefits API without redaction, according to Mohiuddin. Those can contain a veteran’s name, Social Security number, date of birth and address. He is withholding code-level detail until maintainers patch the servers. His report on Japan’s Digital Agency grants server, which had no authentication, also remains open. ‘Protocol pivoting’Mohiuddin calls the wider attack class “protocol pivoting”.
攻击者将文本植入到LCP工具返回的内容中，其形状就像谷歌A2 A协议的任务。编排代理将其传递给子代理，子代理运行它，因为它信任编排器。
An attacker plants text in content an MCP tool returns, shaped like a task for Google’s A2A protocol. An orchestrating agent passes it to a subagent, which runs it because it trusts the orchestrator.
Rapid 7的漏洞情报总监道格拉斯·麦基（Douglas McKee）告诉Ars Technica：“该链条中的每一个部分都完全按照其设计的目的进行了，这就是为什么它很难捕捉。”
“Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch,” Douglas McKee, Rapid7’s director of vulnerability intelligence, told Ars Technica.
X41 D-Sec的Markus Vervier告诉Ars，该技术是间接提示注射的一种形式。Mohiuddin将于10月23日在圣何塞举行的MCPCon North America会议上展示研究结果。
Markus Vervier of X41 D-Sec told Ars that the technique is a form of indirect prompt injection. Mohiuddin will present the findings at MCPCon North America in San Jose on 23 October.