CVE-2026-122140 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Trawl versions from 1.5.0 before 1.10.0 check outbound MCP URLs against a block list, but IPv4-mapped IPv6 addresses such as ::ffff:7f00:1 slip past it, including via redirects. An unauthenticated attacker can make the server fetch loopback, private network and cloud metadata endpoints and read the responses.
first public Nov 3, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Trawl 1.5.0 to before 1.10.0 where the MCP outbound URL feature is reachable by unauthenticated callers. Exposure depends on whether the server can reach internal addresses and cloud metadata endpoints from its network position. Deployments on 1.10.0 or later, or where Trawl is not exposed to untrusted callers, are not affected by this report.
Not affected if no-mcp-url-fetch, version-1.10.0-or-later
Who cares cloud, mcp, trawl
1.5.0 up to but not including 1.10.0.1.10.0 or later.Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.