CVE-2026-5832 | atototo api-lab-mcp up to 0.2.1 HTTP Interface src/mcp/http-server.ts source/url server-side request forgery

A vulnerability, which was classified as critical, has been found in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_test_scenarios/test_http_endpoint of the file src/mcp/http-server.ts of the component HTTP Interface. This manipulation of the argument source/url causes server-side request forgery.

This vulnerability is tracked as CVE-2026-5832. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The project was informed of the problem early through an issue report but has not responded yet.