Definition
Server-Side Request Forgery (SSRF) is an attack where a server is tricked into making HTTP requests to unintended destinations — often internal endpoints — by manipulating user-controlled URLs or redirect behavior.
Key Points
- 2026-10: Recurring pattern in mcp server implementations — Google MCP Toolbox CVE-2026-14540 (CVSS 8.0) via missing CheckRedirect and IP validation (protocol-pivoting)
- Common in agent tool servers where model-supplied URLs reach backend HTTP clients