Log in Start free

Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19339aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in alibabacloud-dataworks-mcp-server from aliyun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
aliyun alibabacloud-dataworks-mcp-server 1.0.01.0.11.0.21.0.31.0.41.0.51.0.61.0.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References