CVE-2026-7146: AlejandroArciniegas mcp-data-vis Vulnerable to SSRF

The National Vulnerability Database has disclosed CVE-2026-7146, a high-severity server-side request forgery (SSRF) vulnerability affecting AlejandroArciniegas mcp-data-vis. Specifically, the vulnerability resides in the axios function within the src/servers/web-scraper/server.js file, part of the HTTP Request Handler component. This flaw allows remote attackers to manipulate HTTP requests, potentially leading to information disclosure, unauthorized access to internal systems, or even arbitrary code execution in some configurations.

The CVSS score of 7.3 (HIGH) underscores the critical nature of this vulnerability, with an attack vector of ‘Network’ and no required user interaction or privileges. The public disclosure of an exploit further elevates the risk, meaning attackers are likely already leveraging this. A significant challenge is that mcp-data-vis operates on a rolling release model, which means traditional versioning for affected and patched releases isn’t available. The project maintainers were notified but have yet to respond, leaving users in a precarious position.

This SSRF isn’t just about fetching internal resources; it’s a pivot point. Attackers can use it to map internal networks, bypass firewalls, and interact with services not directly exposed to the internet. The lack of a clear patch path, combined with public exploit availability, makes this a high-priority threat for any organization running this component. Defenders need to assume compromise if they haven’t implemented compensating controls.