CVE-2026-108786 Details
Description
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability has been identified in houtini-ai seo-crawler-mcp versions through 2.1.5. The issue arises in the 'run_seo_audit' function within 'src/core/CrawlOrchestrator.ts', where user-controlled URLs are accepted without proper validation. This flaw allows attackers to manipulate the MCP server into sending HTTP requests to arbitrary internal network addresses, including localhost and private IP ranges. The vulnerability can be exploited remotely.
To address this vulnerability, it is recommended to implement strict validation and sanitization of all user-supplied URLs. Access to private or internal IP ranges, loopback addresses, and local services should be blocked. Additionally, restrict allowed URL protocols to only those that are necessary and avoid fetching user-controlled resources directly without proper allow-list checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Net-defense/public_exp/issues/1 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/cve/CVE-2026-108786 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/959331 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416565 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416565/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| houtini-ai seo-crawler-mcp | <= 2.1.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |