Google, JPMorgan, Weaviate and two governments shipped the same SSRF flaw in their MCP servers

JPMorgan's open-source documentation-search MCP server had two tools that fetch content. One checked domains against an allowlist. The other fetched any URL the caller supplied, Mohiuddin wrote ^[17]. JPMorgan had forked the component from an AWS project that never fetched the caller's URL at all. Its Responsible Disclosure team confirmed the finding and deployed a fix, according to Mohiuddin ^[18].

The caller in that case is whoever steers the agent. The server sends its request wherever that party points it, internal systems included ^[3]. That party does not have to be the agent's user. In the attack Mohiuddin calls protocol pivoting, someone plants text shaped like a task for Google's A2A protocol inside content an MCP tool returns. An orchestrating agent passes it to a subagent, which runs it because it trusts the orchestrator ^[6]. Ars Technica reported that MCP servers store credentials for each agent and that agents are built to trust every other internal agent ^[10].

"Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch," Douglas McKee, Rapid7's director of vulnerability intelligence, told Ars Technica ^[7]. Markus Vervier of X41 D-Sec told the same outlet that the technique is a form of indirect prompt injection ^[11].

In Tangerang's Wazuh MCP server, a tool advertised SSRF protection. In practice it rejected literal IP addresses and never resolved hostnames, according to a high-severity advisory published on 3 September ^[21]. That makes two of the five fixed servers where a destination check already existed and missed the request that mattered ^[25].

"Watching the same mistake come back from a hyperscaler, a bank, and a national government, one report at a time, is the moment the May argument stopped being a guess," Mohiuddin wrote ^[13]. The evidence is one researcher's reports. They show the same flaw at organisations with, in Ars Technica's words, "little in common except for their use of AI agents" ^[8]. They do not measure how many MCP servers have it.

The two outlets also count differently. TNW's list of five SSRF fixes leaves out Rapid7. Rapid7's bug, CVE-2026-97228, was a GraphQL injection within the operator's own access, and Rapid7 rates it low, at 2.7 ^[22]. Ars Technica described Google and four other organisations acknowledging flaws that spread instructions from one internal agent to others. It named Rapid7 and the US federal government among the organisations whose agents Mohiuddin tested ^[8][9].

A team running its own tool servers can sort each fetch path on two axes. The first is who supplies the destination: fixed configuration, or the agent, caller or data source at call time. The second is where the check runs: on the address text, or on the address the request actually reaches after DNS lookup and redirects. A tool with a fixed destination is outside this flaw, which needs an address taken from the agent ^[3]. The risky quadrant is a destination supplied at call time and checked only as text, or not checked at all. Google's toolbox sat there, with no restrictive redirect policy and no check on target IP addresses ^[14].

The fixes on record take two shapes. Weaviate restricted its Google module's endpoint settings to Google API hosts ^[19]. Google added a guard against DNS rebinding plus lists of allowed and blocked IP ranges ^[16]. I'd start with an allowlist wherever a tool only needs a handful of known hosts, and accept that the tool will then refuse everything else. A general-purpose fetch tool needs Google's approach. That means resolving the hostname and checking the resulting address, the step Tangerang's tool skipped ^[21].