CVE-2026-108786: houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function runseoaudit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments of houtini-ai seo-crawler-mcp up to version 2.1.5 are identified as affected. The vulnerable code is in the Crawler component's run_seo_audit function in src/core/CrawlOrchestrator.ts.
What access does an attacker need?
The attack can be launched remotely, but the supplied severity vector indicates low privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can cause server-side request forgery. The provided vector indicates low impact to confidentiality, integrity, and availability.
Is there public exploit information?
Yes. The exploit has been publicly disclosed and may be used.
Is a fixed version available?
The provided data identifies affected versions only through 2.1.5 and does not identify a fixed version. The vendor was contacted but did not respond to the disclosure.