Otto Support - SSRF and Token Passthrough with MCP

2026-05-07 · Source: Bishop Fox - Bishopfox.com · Field: Technology & Digital — Cybersecurity & Data Privacy, Artificial Intelligence & Machine Learning, Software Development & Engineering · Depth: Advanced, medium

Summary

Server-side request forgery (SSRF) and token passthrough vulnerabilities are re-emerging risks within Model Context Protocol (MCP) servers, despite being well-known web application flaws. These issues, often introduced casually during integrations with enterprise systems like Atlassian and Microsoft, can transform a single mishandled URL into remote code execution (RCE) on a developer's machine or a foothold within a cloud account. Recent disclosures highlight this, including a critical vulnerability chain in mcp-atlassian (CVE-2026-27826, CVSS 8.2), affecting versions prior to 0.17.0, which allowed unauthenticated RCE by exfiltrating sensitive files like AWS credentials. Microsoft's MarkItDown MCP server also exhibited SSRF, enabling IAM role credential retrieval from AWS EC2 instance metadata. Additionally, OpenClaw's marketplace plugin had an SSRF flaw (CVE-2026-41297) via unvalidated redirects. Mitigations include robust destination validation, network segmentation, and largely avoiding token passthrough, or strictly allowlisting destinations if essential.

Key takeaway

For AI Security Engineers or Software Engineers developing MCP integrations, you must prioritize robust input validation and network segmentation. If your MCP server accepts URLs, implement strict destination allowlisting and blocklisting, ensuring checks occur after DNS resolution and redirects. Avoid forwarding client tokens to downstream APIs; instead, use service credentials or token exchange mechanisms like RFC 8693. Failing to enforce these controls risks unauthenticated remote code execution and unauthorized cloud resource access.

Key insights

MCP servers' core functions make them inherently vulnerable to SSRF and token passthrough if inputs are untrusted.

Principles

• Agent tools must operate with minimal necessary privileges.
• Never trust inputs, destinations, or credentials across trust boundaries.
• Tokens require strict audience validation for security.

Method

Prevent SSRF via destination validation, checking resolved IPs against blocklists/allowlists post-DNS and post-redirect. For token passthrough, use service credentials or RFC 8693 token exchange.

In practice

• Validate all URLs accepted by MCP server tools.
• Isolate MCP servers using network segmentation.
• Do not forward client tokens to downstream APIs.

Topics

• Server-Side Request Forgery
• Token Passthrough
• Model Context Protocol
• Vulnerability Management
• Remote Code Execution
• Network Segmentation

Code references

• BishopFox/otto-support
• swisskyrepo/PayloadsAllTheThings

Best for: AI Security Engineer, AI Engineer, Software Engineer

Related on AIssential

• The Complete Guide to Securing Model Context Protocol (MCP) — Securing Model Context Protocol (MCP) involves treating LLM tool invocations as external API requests, requiring comprehensive authentication, authorization, and isolation.
• MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension — AI coding tools' auto-execution of workspace configurations without consent poses a systemic risk for code execution and credential theft.
• Credentials should never reach the model — Never allow raw credentials to enter the AI model process to prevent prompt injection-based exfiltration.
• Connecting MCP servers to Amazon Bedrock AgentCore Gateway using Authorization Code flow — AgentCore Gateway centralizes AI agent tool and server connections, supporting secure OAuth integration.
• MCP OAuth Flows: Implementing Secure Authentication the Right Way — The core problem is unauthenticated AI access to sensitive data via MCP servers, requiring system-to-system OAuth.
• MCP’s Rewrite Isn’t Vindication. It’s Convergence. — The MCP's major revision reflects a convergence of security understanding, not a reactive fix, by addressing core protocol weaknesses.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Bishop Fox - Bishopfox.com.