CVE-2026-19339 PUBLISHED

aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery

Assigner: VulDB
Reserved: 08.08.2026 Published: 09.08.2026 Updated: 09.08.2026

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.3

Product Status

Vendor aliyun
Product alibabacloud-dataworks-mcp-server
Versions
  • Version 1.0.0 is affected
  • Version 1.0.1 is affected
  • Version 1.0.2 is affected
  • Version 1.0.3 is affected
  • Version 1.0.4 is affected
  • Version 1.0.5 is affected
  • Version 1.0.6 is affected
  • Version 1.0.7 is affected
  • Version 1.0.8 is affected
  • Version 1.0.9 is affected
  • Version 1.0.10 is affected
  • Version 1.0.11 is affected
  • Version 1.0.12 is affected
  • Version 1.0.13 is affected
  • Version 1.0.14 is affected
  • Version 1.0.15 is affected
  • Version 1.0.16 is affected
  • Version 1.0.17 is affected
  • Version 1.0.18 is affected
  • Version 1.0.19 is affected
  • Version 1.0.20 is affected
  • Version 1.0.21 is affected
  • Version 1.0.22 is affected
  • Version 1.0.23 is affected
  • Version 1.0.24 is affected
  • Version 1.0.25 is affected
  • Version 1.0.26 is affected
  • Version 1.0.27 is affected
  • Version 1.0.28 is affected
  • Version 1.0.29 is affected
  • Version 1.0.30 is affected
  • Version 1.0.31 is affected
  • Version 1.0.32 is affected
  • Version 1.0.33 is affected
  • Version 1.0.34 is affected
  • Version 1.0.35 is affected
  • Version 1.0.36 is affected
  • Version 1.0.37 is affected
  • Version 1.0.38 is affected
  • Version 1.0.39 is affected
  • Version 1.0.40 is affected
  • Version 1.0.41 is affected
  • Version 1.0.42 is affected
  • Version 1.0.43 is affected

Credits

  • gongyanyu04 (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Server-Side Request Forgery CWE