Description
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aliyun | alibabacloud-dataworks-mcp-server | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, 1.0.30, 1.0.31, 1.0.32, 1.0.33, 1.0.34, 1.0.35, 1.0.36, 1.0.37, 1.0.3… | — |
References
- VDB-387175 | aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery vdb-entry technical-description
- VDB-387175 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-19339 | CVE Analysis and Report third-party-advisory
- Submit #865263 | aliyun alibabacloud-dataworks-mcp-server 1.0.43 Server-Side Request Forgery third-party-advisory
- https://github.com/aliyun/alibabacloud-dataworks-mcp-server/issues/27 issue-tracking
- https://github.com/aliyun/alibabacloud-dataworks-mcp-server/ product