What happened
An MCP tool that lets an AI agent fetch OpenAPI/Swagger specs performs no validation on the target URL, enabling classic SSRF when the agent (or an attacker manipulating agent input) supplies an internal or cloud-metadata URL. CVSS 6.3 (Medium).
Why it matters
Demonstrates the recurring MCP-server SSRF pattern where any 'fetch a URL' tool exposed to an LLM agent becomes a pivot into internal infrastructure if the agent can be steered (via prompt injection or malicious task input) toward attacker-chosen URLs.
Attack vector
The loadSource function in src/utils/swagger-parser.ts, invoked via the fetch_swagger MCP tool, fetches an attacker-supplied URL without validation, allowing SSRF against internal network resources.
Affected systems
swagger-testcase-mcp (eyaushev/swagger-testcase-mcp), commit 5babb27
Mitigation
No fixed version identified at disclosure; restrict egress from the MCP server host and validate/allowlist swagger source URLs.