What happened
The MCP outbound URL policy fails to reject IPv4-mapped IPv6 forms of loopback/private addresses, so a crafted target or redirect bypasses the allowlist and lets the MCP server fetch endpoints it was supposed to block — enabling SSRF to internal services.
Why it matters
MCP servers often hold credentials and can reach internal networks. An SSRF bypass of the outbound allowlist lets an attacker use the agent's MCP server to reach internal/metadata endpoints, potentially leaking secrets or pivoting into the internal network.
Attack vector
The MCP outbound URL policy normalizes IPv4-mapped IPv6 addresses incorrectly, so an attacker supplies a hex-normalized address like ::ffff:7f00:1 (directly or via redirect) to make the MCP server fetch loopback/private/metadata endpoints that the policy intended to block.
Affected systems
Trawl 1.5.0 < 1.10.0
Mitigation
Upgrade Trawl to >=1.10.0 and verify the outbound-policy normalization; audited in apps/api/src/outbound-policy.ts.