CVE-2026-19957
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. It affects the fetch function in src/tools.ts of the ssrf-test Endpoint component. Manipulating the url argument leads to server-side request forgery. The attack can be launched remotely and the exploit is public.
Risk Assessment
Ability to send requests to internal network resources, potentially leading to data exposure or attacks on other systems. Public exploit increases risk.
Recommendation
Update to a patched version if available. Restrict access to the service and filter outbound traffic.
Original NVD description (English source)
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.