MCP projects of multiple organizations have SSRF vulnerabilities, researchers warn about AI agent trust issues

Independent security researcher Syed Anas Mohiuddin published MCP security research findings, discovering server-side request forgery (SSRF) vulnerabilities in the MCP projects of multiple organizations including Google and JPMorgan Chase. Among them, Google's database access tool MCP Toolbox for Databases has a high-risk SSRF vulnerability CVE-2026-14540, with a CVSS score of 8.0, stemming from the HTTP client's lack of URL redirect checks and destination IP address validation. The researcher calls the technique of using trust relationships between different protocols to gradually expand the attack scope Protocol Pivoting; attackers can implant malicious instructions into external content read by AI agents, which are then passed along with tasks between agents. Google has patched the vulnerability, with measures including checking the destination IP address when establishing network connections and restricting the connection scope through IP allowlists and blocklists.