CVE-2026-108786
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-918
Impact
Authenticated remote attackers can trigger server-side request forgery (SSRF) against internal or external systems. They only need low-privilege network access to invoke the audit endpoint.
Root cause
The run_seo_audit function in src/core/CrawlOrchestrator.ts fails to validate target URLs before sending crawler requests.
Affected systems
houtini-ai seo-crawler-mcp up to 2.1.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No patched version is currently available from the vendor. Block access to the seo-crawler-mcp service or restrict egress network traffic from the host to prevent requests to internal infrastructure and metadata endpoints.
$ npm list seo-crawler-mcpAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.