CVE-2026-5832

The record

A weakness has been identified in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_test_scenarios/test_http_endpoint of the file src/mcp/http-server.ts of the component HTTP Interface. This manipulation of the argument source/url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages

Related vulnerabilities

• GHSA-crh9-3gjh-m6gc api-lab-mcp vulnerable to SSRF Same vulnerability
• CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918
• CVE-2026-87953 Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider… CWE-918
• CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in… CWE-918
• CVE-2026-112288 Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that… CWE-918
• CVE-2026-111936 Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability… CWE-918
• CVE-2026-94483 Next.js is a React framework for building full-stack web applications. CWE-918
• CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-918