Algovate xhs-mcp SSRF Vulnerability (CVE-2026-7417) Publicly Disclosed
The National Vulnerability Database has detailed CVE-2026-7417, a critical server-side request forgery (SSRF) vulnerability affecting Algovate xhs-mcp version 0.8.11. Specifically, the flaw resides within the xhs_publish_content function of the src/server/mcp.server.ts file, part of the MCP Interface component. An attacker can manipulate the media_paths argument to trigger the SSRF, allowing remote exploitation.
This vulnerability carries a CVSSv3.1 score of 7.3 (HIGH), indicating a significant risk. The attack requires no authentication or user interaction, making it particularly dangerous. The National Vulnerability Database notes that exploit details have been made public, dramatically increasing the likelihood of active exploitation. Algovate was reportedly informed via an issue report but has not yet responded.
An SSRF vulnerability allows an attacker to coerce the server-side application into making requests to an arbitrary domain of the attacker’s choosing. This can lead to sensitive data exposure, access to internal systems, or even arbitrary code execution in some configurations. The public exploit availability means defenders should assume active scanning and exploitation attempts are underway.
What This Means For You
- If your organization uses Algovate xhs-mcp 0.8.11, immediately isolate affected instances. This SSRF vulnerability (CVE-2026-7417) is remotely exploitable without authentication, and public exploit code is available. Assume compromise and audit network logs for outbound connections from xhs-mcp servers to unusual or internal IP addresses.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7417 - Algovate xhs-mcp SSRF via media_paths
title: CVE-2026-7417 - Algovate xhs-mcp SSRF via media_paths
id: scw-2026-04-29-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-7417 by targeting the xhs_publish_content function in Algovate xhs-mcp. The rule specifically looks for requests containing '/xhs_publish_content' and the 'media_paths=' parameter in the URI query, which is indicative of an SSRF attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7417/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/xhs_publish_content'
cs-uri-query|contains:
- 'media_paths='
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7417 | SSRF | Algovate xhs-mcp 0.8.11 |
| CVE-2026-7417 | SSRF | Vulnerable function: xhs_publish_content in src/server/mcp.server.ts |
| CVE-2026-7417 | SSRF | Vulnerable component: MCP Interface |
| CVE-2026-7417 | SSRF | Manipulation of argument: media_paths |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 30, 2026 at 01:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
UTT HiPER 1250GW: High-Severity Buffer Overflow (CVE-2026-7418)
CVE-2026-7418 — A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function strcpy of the file route/goform/NTP. Executing a...
PolarVista xcode-mcp-server Suffers High-Severity OS Command Injection
CVE-2026-7416 — A vulnerability was found in PolarVista xcode-mcp-server 1.0.0. This issue affects the function build_project/run_tests of the file src/index.ts of the component MCP Interface....
CVE-2026-7410 — SourceCodester Pizzafy Ecommerce System SQL Injection
CVE-2026-7410 — A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_to_cart. The manipulation of...