Server-Side Request Forgery in AlejandroArciniegas mcp-data-vis Product
CVE-2026-7146

6.9MEDIUM

Key Information:

Vendor

Alejandroarciniegas

Status
Mcp-data-vis
Vendor
CVE Published:
27 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-7146?

A security vulnerability has been identified within the mcp-data-vis product by AlejandroArciniegas that exposes the system to server-side request forgery (SSRF). This flaw arises from the handling of HTTP requests in the axios function located in the src/servers/web-scraper/server.js file. Malicious actors can exploit this weakness to initiate requests from the server, potentially leading to data leaks or unauthorized actions. The vulnerability affects all versions up to a specific commit and has been publicly disclosed, making it critical for users to mitigate their risk by reviewing product usage and monitoring for any unauthorized access attempts.

Affected Version(s)

mcp-data-vis de5a51525a69822290eaee569a1ab447b490746d

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-7146 - Proof of Concept

References

https://vuldb.com/vuln/359745
vdb-entrytechnical-description
https://vuldb.com/vuln/359745/cti
signaturepermissions-required
https://vuldb.com/submit/801895
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

MidA (VulDB User)
VulDB CNA Team
.