CVE-2026-10280: Server-Side Request Forgery in Horizon921 mcpilot 0.1.0

Technical summary

The vulnerability exists in the MCP API Call Endpoint (client/src/app/api/mcp/call/route.ts) where insufficient input validation on the serverBaseUrl argument permits server-side request forgery. An unauthenticated remote attacker can supply a malicious serverBaseUrl value that causes the application server to initiate requests on their behalf, potentially targeting internal services, cloud metadata endpoints, or other systems. The attack vector is network-based with low complexity and no user interaction required, making it easily exploitable by a remote adversary. CWE-918 (Server-Side Request Forgery) applies directly.

Business impact

Organizations deploying mcpilot 0.1.0 face exposure of internal service enumeration, potential data exfiltration through cloud metadata endpoints (if deployed in containerized or cloud environments), and lateral movement opportunities to backend systems. The combination of network accessibility, public exploit availability, and ease of exploitation creates operational risk. Any integrations or downstream systems the mcpilot instance can reach become potential targets. Development teams should prioritize remediation to prevent reconnaissance and unauthorized internal access.

Affected systems

Horizon921 mcpilot version 0.1.0 is affected. The vulnerability resides in the MCP API Call Endpoint component. Any deployment of this specific version is potentially at risk if the endpoint is accessible from untrusted networks.

Exploitability

This vulnerability is highly exploitable. The attack requires no authentication, no user interaction, and low technical complexity. An attacker need only craft a malicious HTTP request with a crafted serverBaseUrl parameter. Public exploit code has already been released, lowering the barrier to weaponization. Active exploitation is a realistic near-term risk.

Remediation

Immediately discontinue use of mcpilot 0.1.0. Contact Horizon921 for patched releases or interim guidance; as of the vulnerability publication date, the project had not yet responded to notifications. Implement network segmentation to restrict the mcpilot instance's outbound connectivity to only necessary endpoints. Apply strict input validation and allowlisting for any URL parameters in future deployments. If an upgrade is available, deploy it after testing.

Patch guidance

Check Horizon921's official advisories and release channels for patched versions of mcpilot. Given the public disclosure and available exploits, patching should be treated as urgent. Verify the patch against the vendor's signed release notes before deployment. If no patch has been released by the vendor, consider isolating or decommissioning affected instances until remediation is available.

Detection guidance

Monitor web server access logs and API gateway logs for requests to the /api/mcp/call endpoint containing suspicious or internal-looking serverBaseUrl values. Watch for outbound HTTP/HTTPS connections from the mcpilot instance to unexpected internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata services (169.254.169.254, equivalent Azure endpoints). Network intrusion detection systems should flag outbound requests from the application tier to infrastructure services or databases.

Why prioritize this

Despite a CVSS score of 7.3 (HIGH), the prioritization case is compelling: (1) a public exploit exists, significantly shortening attack timeline; (2) the vulnerability is trivial to exploit—no credentials, no complex payload construction; (3) it opens pathways to internal systems and sensitive metadata; (4) the vendor had not yet responded at publication. Any organization running 0.1.0 should treat this as urgent.

Risk score, explained

CVSS 3.1 base score 7.3 (HIGH) reflects high attack vector (network, unauthenticated, no user interaction) combined with confidentiality, integrity, and availability impacts. The score does not account for public exploit availability or vendor unresponsiveness, which in practice elevate operational risk beyond the base metric.

Frequently asked questions