CVE-2026-19765: eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery
A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetchswagger. Performing a manipulation results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19765?
The severity of CVE-2026-19765 is medium with a score of 6.3.
What kind of vulnerability is CVE-2026-19765?
CVE-2026-19765 is classified as a server-side request forgery (SSRF) vulnerability.
What component is affected by CVE-2026-19765?
CVE-2026-19765 affects the fetch_swagger component in the eyaushev swagger-testcase-mcp.
How does CVE-2026-19765 impact security?
CVE-2026-19765 can potentially allow attackers to manipulate requests made by the server, leading to unauthorized access to sensitive internal resources.
How can I mitigate CVE-2026-19765?
To mitigate CVE-2026-19765, you should update to a patched version of the eyaushev swagger-testcase-mcp that resolves this SSRF vulnerability.