Unverified50% confidenceEventExact time
Google, JPMorgan Chase, Weeviate, the French digital affairs agency, and a municipal government in Indonesia each fixed SSRF vulnerabilities in their MCP servers.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/14/2026
First Seen
Valid until: 10/28/2026
Sources
Related Entities
Related Claims
UnverifiedGoogle rated the SSRF vulnerability in its MCP server as high severity.68% similarUnverifiedIndependent security researcher Syed Anas Mohi Uddin discovered the same security flaw in MCP servers belonging to Google, JPMorgan Chase, and three other organizations: a tool that fetches a given URL without verifying where the address actually points.65% similarVerifiedRepresentative domestic SRC platforms include Butian (operated by QiAnXin) and Vulbox, while internationally there are HackerOne and Bugcrowd.58% similarUnverifiedSince 2022, pro-Russian hacker groups have launched hundreds of DDoS attacks against NATO countries supporting Ukraine, with targets including government websites, airport systems, and banking services.57% similarUnverifiedAPT41与中国相关，Cozy Bear（APT29）与俄罗斯相关，这些组织曾多次攻击美国政府机构57% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1029720API
curl https://kongchang.com/api/v1/knowledge/claims/1029720MCP
get_claim(id=1029720)