What happened
An MCP download-report tool exposes an unvalidated URL parameter that the server fetches server-side, permitting SSRF. CVSS 5.3 (Medium).
Why it matters
Another instance of the SSRF-via-agent-tool pattern seen across multiple MCP servers this period; narrow blast radius since fm-mcp-servers is a niche single-vendor toolset, but illustrates a systemic MCP design flaw.
Attack vector
The downloadReport function in src/smadex-reporting/src/index.ts accepts an attacker-controlled downloadUrl argument and fetches it without validation, enabling SSRF against internal services from the MCP server host.
Affected systems
fm-mcp-servers (feed-mob/fm-mcp-servers) 0.0.3
Mitigation
No fixed version confirmed at disclosure; restrict outbound network access from the MCP host and validate/allowlist downloadUrl targets.