mcp-webresearch SSRF via Prompt-Injected URL Navigation
First seen Jul 22, 2026 · Updated Jul 22, 2026 · CVSS 8.2
The mcp-webresearch MCP server's visit_page tool fails to filter private, loopback, or cloud metadata IP ranges before directing its Playwright browser to fetch a URL. An attacker who can influence the LLM's tool arguments (e.g., via prompt injection from a webpage the agent reads) can redirect the server to internal endpoints like cloud metadata services, leaking sensitive internal data or credentials into the model's context.
Technical Analysis
The visit_page tool only validates URL scheme (e.g., http/https) but does not block requests to loopback (127.0.0.1), link-local (169.254.x.x), or other reserved IP ranges, enabling classic SSRF. Because the URL argument is LLM-controlled, an attacker embedding instructions in untrusted content (a webpage, search result, or document the agent processes) can perform indirect prompt injection to coerce the model into calling visit_page with an attacker-chosen internal address such as the AWS/GCP/Azure metadata endpoint (169.254.169.254). The tool's underlying Playwright browser then fetches that internal resource server-side, and the response content—potentially including instance credentials, IAM tokens, or internal service data—is returned into the model's context window, crossing the trust boundary from network-layer isolation into the LLM's conversational state where it may be further exfiltrated, logged, or acted upon.
Affected Systems
mcp-webresearch; protocols: MCP
Detection Signatures
- Outbound requests from MCP server process to 169.254.169.254 or other cloud metadata IPs
- visit_page tool calls with loopback (127.0.0.1, ::1) or link-local (169.254.x.x) targets
- URL arguments containing internal hostnames (e.g., .internal, .local) or raw private IP literals (10.x, 172.16-31.x, 192.168.x)
- Playwright/browser network logs showing navigation to non-public IP ranges shortly after ingesting untrusted external content
- Tool call arguments populated from webpage content without explicit user confirmation
Remediation Steps
- 1
Upgrade mcp-webresearch
Update to a patched version once available that enforces IP-range allow/deny lists in addition to protocol validation.
- 2
Implement SSRF-aware URL validation
Resolve hostnames and block requests to RFC1918, loopback, link-local, and cloud metadata ranges before the browser navigates, including after redirects.
- 3
Isolate network egress
Run the MCP web-research server in a network namespace/VPC with no route to internal services or cloud metadata endpoints; use egress proxies with allow-lists.
- 4
Sanitize tool arguments from untrusted content
Treat any URL derived from fetched web content as untrusted; require explicit user approval before navigation to non-allowlisted domains.
- 5
Disable IMDSv1 / enforce IMDSv2
On cloud hosts, require token-based metadata requests (IMDSv2) to reduce blind SSRF impact against metadata services.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.