7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45609

CVE-2026-45609: mcp-security: Unvalidated URL Fetching (SSRF)

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to the network. This only affects installations with Dynamic Client Registration (DCR) enabled This vulnerability is fixed in 0.1.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45609

CVE-2026-45609:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.springaicommunity:mcp-client-security	maven	< 0.1.9	0.1.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) within the mcp-client-security library, specifically in the Dynamic Client Registration (DCR) feature. The root cause is the lack of input validation on URLs received from a potentially untrusted Model Context Protocol (MCP) server.

When DCR is enabled (spring.ai.mcp.client.authorization.dynamic-client-registration.enabled=true), the application attempts to dynamically register itself as an OAuth2 client. This process involves several steps where URLs are fetched and used:

Metadata Discovery: The McpMetadataDiscoveryService.getProtectedResourceMetadata function is called with a URL to fetch protected resource metadata. Before the patch, this URL was not validated, allowing an attacker to point it to an internal service.
Client Registration: The DynamicClientRegistrationService.register function is used to perform the registration. It takes an authorization server URL, discovers a registration endpoint from it, and then sends the registration request. Both the initial authorization server URL and the discovered endpoint were used without validation.
Client Configuration: The DefaultMcpOAuth2ClientManager.registerMcpClient method creates and stores a ClientRegistration object. This object contains several URLs for the OAuth2 flow (e.g., token endpoint, authorization endpoint, JWKS URI) that are extracted from the server's response. These URLs were not validated, meaning a compromised or malicious MCP server could configure the client to send requests to internal endpoints.

The patch addresses this by introducing a UrlValidator component that is used across these services to enforce that all externally-provided URLs conform to a security policy (e.g., requiring HTTPS and not pointing to internal or loopback addresses unless explicitly configured for development). By validating all URLs before they are used in HTTP requests, the patch effectively mitigates the SSRF vulnerability.

Vulnerable functions

org.springaicommunity.mcp.security.client.sync.oauth2.metadata.McpMetadataDiscoveryService.getProtectedResourceMetadata

mcp-client-security/src/main/java/org/springaicommunity/mcp/security/client/sync/oauth2/metadata/McpMetadataDiscoveryService.java

The `getProtectedResourceMetadata` function is vulnerable to Server-Side Request Forgery (SSRF) because it directly uses the `resourceMetadataUrl` parameter to make an HTTP request without prior validation. An attacker could provide a URL pointing to an internal service, tricking the application into sending requests on their behalf. The patch mitigates this by introducing a `UrlValidator` to validate the URL before it is used.

org.springaicommunity.mcp.security.client.sync.oauth2.registration.DynamicClientRegistrationService.register

mcp-client-security/src/main/java/org/springaicommunity/mcp/security/client/sync/oauth2/registration/DynamicClientRegistrationService.java

The `register` function in `DynamicClientRegistrationService` is vulnerable to SSRF. It uses the `authServerUrl` to discover an OpenID Connect `registration_endpoint`. Neither the provided `authServerUrl` nor the discovered endpoint URL were validated before being used for HTTP requests. This allows an attacker to specify a malicious `authServerUrl` that resolves to an internal system, causing the application to make requests to internal services. The patch adds URL validation for both the authorization server URL and the registration endpoint.

org.springaicommunity.mcp.security.client.sync.oauth2.registration.DefaultMcpOAuth2ClientManager.registerMcpClient

mcp-client-security/src/main/java/org/springaicommunity/mcp/security/client/sync/oauth2/registration/DefaultMcpOAuth2ClientManager.java

The `registerMcpClient` method orchestrates the dynamic client registration process. It was vulnerable because it would construct a `ClientRegistration` object containing several URLs (e.g., `token_endpoint`, `authorization_endpoint`) provided by an untrusted MCP server and did not validate them. Subsequent operations using this `ClientRegistration` object would then make requests to these unvalidated URLs, leading to an SSRF vulnerability. The patch introduces the `validateClientRegistration` method to verify all provider-related URLs before the registration is stored and used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.