CVE-2026-14748: Server-Side Request Forgery in AIAnytime Awesome-MCP-Server wiki-summary

Technical summary

The vulnerability exists in mcp-wiki/src/mcp_wiki/server.py within the wiki-summary functionality. The flaw allows authenticated users to inject arbitrary URLs via the 'url' parameter, causing the server to initiate requests on their behalf. This is a classic SSRF attack (CWE-918) that bypasses network segmentation and can lead to unauthorized access to internal services, metadata endpoints, or external systems. The CVSS 3.1 score of 6.3 (MEDIUM) reflects that authentication is required, but the confidentiality, integrity, and availability impacts are non-negligible. Notably, a proof-of-concept exploit has already been published, lowering the barrier to exploitation.

Business impact

SSRF vulnerabilities can expose internal infrastructure, enable lateral movement, and compromise data confidentiality. In a rolling-release project, patch deployment is non-standard, making it difficult to establish a clear remediation timeline. Organizations relying on Awesome-MCP-Server for wiki functionality should assess whether the component handles requests to sensitive internal APIs or metadata services (e.g., cloud instance credentials). Delayed vendor response increases risk, as active exploits may proliferate before official guidance is issued.

Affected systems

AIAnytime Awesome-MCP-Server up to commit a884bb51bcd99e08e14fd712c749d55d9d9a13ab is affected. The project uses a rolling release model, so there are no traditional version numbers. Any deployment of the mcp-wiki/wiki-summary component at or before the noted commit is potentially vulnerable. Organizations should identify all instances of this software in their infrastructure, including development, staging, and production environments.

Exploitability

Exploitation requires valid authentication credentials, which moderates immediate risk in well-segmented networks. However, the published proof-of-concept lowers the technical bar for attack execution. The attack surface is remote and easy to trigger (AC:L), making it practical for any authenticated user to probe. If internal services or metadata endpoints are accessible from the server, the impact escalates significantly. The lack of vendor response and public exploit code mean defenders cannot rely on rapid patch availability.

Remediation

No official patch is currently available due to the rolling release model and lack of vendor response. Immediate actions should include: (1) isolating or restricting network access to affected Awesome-MCP-Server instances, (2) implementing strict egress filtering to block unexpected outbound connections, (3) monitoring the project's repository for commits addressing CWE-918, and (4) reviewing authentication logs for suspicious 'url' parameter usage. Consider disabling the wiki-summary component if it is not critical, or running it in a sandboxed environment with minimal network privileges.

Patch guidance

Verify the current commit hash of your deployed Awesome-MCP-Server against the affected commit (a884bb51bcd99e08e14fd712c749d55d9d9a13ab) via your repository or package manager. Given the rolling release model, monitor the project's commit history and release notes for security fixes related to SSRF or CWE-918. When updates become available, prioritize deployment in non-production environments first. Because the vendor has not yet publicly confirmed a fix, engage with the project's issue tracker or community channels to confirm patch status before upgrading.

Detection guidance

Monitor application logs for unusual 'url' parameter values in requests to the wiki-summary endpoint—particularly URLs pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, or cloud metadata endpoints (e.g., 169.254.169.254). Enable network-level monitoring to detect unexpected outbound connections from the Awesome-MCP-Server process, especially to internal services or restricted networks. Correlate authentication logs with wiki-summary endpoint access to identify suspicious patterns. Deploy a Web Application Firewall (WAF) rule set to reject requests with suspicious URL parameters if feasible.

Why prioritize this

Although the CVSS score is MEDIUM (6.3) and authentication is required, the combination of a published exploit, lack of vendor response, and potential for lateral movement or data exposure warrants prompt investigation. SSRF vulnerabilities are often underestimated but can be weaponized to bypass perimeter security and reach sensitive internal systems. Organizations should prioritize identifying and isolating affected instances while awaiting official guidance.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) that requires authenticated access (PR:L). The impact on confidentiality, integrity, and availability is limited (C:L/I:L/A:L) in a default configuration, but in environments where the server can reach internal APIs, metadata services, or databases, the actual risk is substantially higher. The published exploit and vendor non-response elevate practical risk despite the moderate base score.

Frequently asked questions