{"id":"CVE-2026-122140","kind":"vulnerability","aliases":["CVE-2026-122140"],"related":[],"title":"Trawl: MCP URL policy bypass lets attackers reach internal services","description":"Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.","summary":"Trawl versions from 1.5.0 before 1.10.0 check outbound MCP URLs against a block list, but IPv4-mapped IPv6 addresses such as ::ffff:7f00:1 slip past it, including via redirects. An unauthenticated attacker can make the server fetch loopback, private network and cloud metadata endpoints and read the responses.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","cloud","mcp","trawl"],"not_affected_if":["no-mcp-url-fetch","version-1.10.0-or-later"],"how_to_check":"- Check the installed Trawl version; affected if it is `1.5.0` up to but not including `1.10.0`.\n- Look for MCP URL fetching enabled on servers reachable from untrusted networks.","fix":"- Move to Trawl `1.10.0` or later.","status":"open","published_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:21+00:00","triaged_at":"2026-11-04T21:51:12+00:00","updated_at":"2026-11-04T21:51:12+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-04T21:51:12Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Trawl `1.10.0` or later.","reach":"internet","title":"Trawl: MCP URL policy bypass lets attackers reach internal services","impact":"medium","summary":"Trawl versions from 1.5.0 before 1.10.0 check outbound MCP URLs against a block list, but IPv4-mapped IPv6 addresses such as ::ffff:7f00:1 slip past it, including via redirects. An unauthenticated attacker can make the server fetch loopback, private network and cloud metadata endpoints and read the responses.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["trawl","mcp","cloud"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"internal services and cloud metadata readable by attacker","analyst_note":"Confirm the exact default configuration and whether the MCP URL feature is on by default, via the vendor advisory linked from the NVD entry.","how_to_check":"- Check the installed Trawl version; affected if it is `1.5.0` up to but not including `1.10.0`.\n- Look for MCP URL fetching enabled on servers reachable from untrusted networks.\n- unknown whether the sources name a specific configuration check beyond the version.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.10.0-or-later","no-mcp-url-fetch"],"who_is_affected":"Teams running Trawl 1.5.0 to before 1.10.0 where the MCP outbound URL feature is reachable by unauthenticated callers. Exposure depends on whether the server can reach internal addresses and cloud metadata endpoints from its network position. Deployments on 1.10.0 or later, or where Trawl is not exposed to untrusted callers, are not affected by this report.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4239,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-122140':13A,16A '-2026':12A,15A '1':47B,112C '1.10.0':28B,76C '1.5.0':26B,74C '7f00':46B,111C 'address':42B,101C,108C 'ai':18B 'ai-tool':17B 'allow':86C 'attack':7A,56B,88C,102C 'block':35B 'bypass':5A,90C 'check':29B 'cloud':20B,66B,122C 'contain':77C 'cve':11A,14A 'direct':113C 'endpoint':68B 'fetch':61B,118C 'ffff':45B,110C 'forgeri':83C 'hex':106C 'hex-norm':105C 'includ':51B 'intern':9A 'ipv4':39B,98C 'ipv4-mapped':38B,97C 'ipv6':41B,100C 'let':6A 'like':109C 'list':36B 'loopback':62B,119C 'make':58B 'map':40B,99C 'mcp':2A,21B,31B,92C 'metadata':67B,123C 'network':64B 'normal':107C 'outbound':30B,93C 'past':49B 'polici':4A,95C 'privat':63B,120C 'reach':8A 'read':70B,126C 'redirect':53B,116C 'request':82C 'respons':72B,127C 'server':60B,80C 'server-sid':79C 'servic':10A,124C 'side':81C 'slip':48B 'suppli':104C 'tool':19B 'trawl':1A,22B,23B,73C 'unauthent':55B,87C 'url':3A,32B,94C 'use':96C 'version':24B 'via':52B,115C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams running Trawl 1.5.0 to before 1.10.0 where the MCP outbound URL feature is reachable by unauthenticated callers. Exposure depends on whether the server can reach internal addresses and cloud metadata endpoints from its network position. Deployments on 1.10.0 or later, or where Trawl is not exposed to untrusted callers, are not affected by this report.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","cloud","mcp","medium","trawl"],"campaign_type":null,"first_public_at":"2026-11-03T23:47:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122140","severity":null,"published_at":"2026-11-04T21:18:10+00:00","modified_at":"2026-11-04T21:18:10+00:00","first_seen_at":"2026-11-04T21:49:21+00:00","fetched_at":"2026-11-04T21:49:21+00:00","note":null}],"documents":[{"id":70684,"url":"https://github.com/germondai/trawl/commit/17cdb33a9a6a8200cf8f9fd6a57b295b04ee5173","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70685,"url":"https://github.com/germondai/trawl/releases/tag/v1.10.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70686,"url":"https://github.com/germondai/trawl/security/advisories/GHSA-mj45-84p2-v77q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T23:47:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":70687,"url":"https://www.vulncheck.com/advisories/trawl-1.5.0-before-1.10.0-ssrf-via-ipv4-mapped-ipv6-mcp-policy-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}