CVE-2026-7221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7221
Published
2026-04-28T03:30:19.669Z
Modified
2026-07-15T01:49:17.407682573Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery
Details

A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-server.ts of the component open-url API Endpoint. The manipulation of the argument req.body.url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.17.1 is able to address this issue. The patch is identified as 3f678a1e7bd400cd76469d61024097d4920dc6b5. It is recommended to upgrade the affected component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7221.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.2"
                },
                {
                    "last_affected": "2.2"
                },
                {
                    "introduced": "2.4"
                },
                {
                    "last_affected": "2.4"
                },
                {
                    "introduced": "2.5"
                },
                {
                    "last_affected": "2.5"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7"
                },
                {
                    "introduced": "2.15"
                },
                {
                    "last_affected": "2.15"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/tencentcloudbase/cloudbase-mcp

Affected ranges

Type
GIT
Repo
https://github.com/tencentcloudbase/cloudbase-mcp
Events
Introduced
359c1e0d6beba229a55203046d884c02222d3bf9
Fixed
3f678a1e7bd400cd76469d61024097d4920dc6b5
Fixed
632f42db39619a56aed5f2df575a18dd2915adf1
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3"
        },
        {
            "introduced": "2.6"
        },
        {
            "last_affected": "2.6"
        },
        {
            "introduced": "2.8"
        },
        {
            "last_affected": "2.8"
        },
        {
            "introduced": "2.9"
        },
        {
            "last_affected": "2.9"
        },
        {
            "introduced": "2.10"
        },
        {
            "last_affected": "2.10"
        },
        {
            "introduced": "2.11"
        },
        {
            "last_affected": "2.11"
        },
        {
            "introduced": "2.12"
        },
        {
            "last_affected": "2.12"
        },
        {
            "introduced": "2.13"
        },
        {
            "last_affected": "2.13"
        },
        {
            "introduced": "2.14"
        },
        {
            "last_affected": "2.14"
        },
        {
            "introduced": "2.16"
        },
        {
            "last_affected": "2.16"
        },
        {
            "introduced": "2.17.0"
        },
        {
            "last_affected": "2.17.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.0
2.1
2.10
2.11
2.12
2.13
2.14
2.16
2.17.0
2.3
2.6
2.8
2.9
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.1
v2.12.0
v2.12.1
v2.13.0
v2.14.0
v2.14.0-beta.1
v2.14.1
v2.14.2
v2.15.0-beta.1
v2.15.2
v2.15.2-beta.1
v2.15.2-beta.2
v2.15.2-beta.3
v2.15.3
v2.15.4
v2.16.1
v2.16.1-beta.1
v2.17.0
v2.17.0-beta.1
v2.17.0-beta.2
v2.3.0
v2.6.1
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.6
v2.7.7
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7221.json"