Server-Side Request Forgery

Server-side request forgery, usually shortened to SSRF, is a flaw where an attacker tricks a web application's server into making requests to destinations the attacker chose, often internal systems that are not meant to be reachable from outside. This can expose cloud account credentials, internal dashboards, and customer data sitting behind the company's firewall. For AI deployments, it matters because tools that fetch URLs, plugins, and agents that browse the web can become the path an attacker uses to reach those internal resources.

1 item

ResearchGlobal2026-10-09

Google, JPMorgan, and Two Governments Exposed by Recurring MCP Server Flaw

Security researchers found a recurring vulnerability in MCP (Model Context Protocol) servers run by Google, JPMorgan Chase, Weaviate, France's DINUM, and Tangerang City. The flaw lets AI agents manipulate outbound network requests and relay malicious instructions to other agents. It exposes a structural gap in how organizations deploy the protocol that connects AI agents to external systems. Researchers recommend destination validation, network isolation, and explicit authorization controls for inter-agent transactions.

MCP agentic AI multi-agent systems Google JPMorgan Chase server-side request forgery agent security authorization