OASB
Attacks/MCP Exploitation/MCP-007
HIGHCWE-918

MCP-007 MCP SSRF to Internal Service

MCP Exploitation: Attempts to exploit MCP tool call parameters (path traversal, command injection, SSRF)

Description

Attempts SSRF to internal service via localhost

Remediation

Block requests to localhost and internal service ports. Use URL allowlists.

Severity

HIGH

OASB Control

2.3

CWE

CWE-918
PreviousMCP-006 MCP SSRF to Cloud MetadataNextMCP-008 MCP SQL Injection