CVE-2026-7221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7221
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7221.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7221
Published
2026-04-28T03:30:19.669Z
Modified
2026-08-04T11:50:37.918495231Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery
Details

A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-server.ts of the component open-url API Endpoint. The manipulation of the argument req.body.url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2.17.1 is able to address this issue. The patch is identified as 3f678a1e7bd400cd76469d61024097d4920dc6b5. It is recommended to upgrade the affected component.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7221.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.2"
                },
                {
                    "last_affected": "2.2"
                },
                {
                    "introduced": "2.4"
                },
                {
                    "last_affected": "2.4"
                },
                {
                    "introduced": "2.5"
                },
                {
                    "last_affected": "2.5"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7"
                },
                {
                    "introduced": "2.15"
                },
                {
                    "last_affected": "2.15"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/TencentCloudBase/CloudBase-AI-Toolkit

Affected ranges

Type
GIT
Repo
https://github.com/TencentCloudBase/CloudBase-AI-Toolkit
Events
Introduced
359c1e0d6beba229a55203046d884c02222d3bf9
Last affected
00f0887716a0bae2ffd6d2f8dd4963462901a19d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3"
        },
        {
            "introduced": "2.6"
        },
        {
            "last_affected": "2.6"
        },
        {
            "introduced": "2.8"
        },
        {
            "last_affected": "2.8"
        },
        {
            "introduced": "2.9"
        },
        {
            "last_affected": "2.9"
        },
        {
            "introduced": "2.10"
        },
        {
            "last_affected": "2.10"
        },
        {
            "introduced": "2.11"
        },
        {
            "last_affected": "2.11"
        },
        {
            "introduced": "2.12"
        },
        {
            "last_affected": "2.12"
        },
        {
            "introduced": "2.13"
        },
        {
            "last_affected": "2.13"
        },
        {
            "introduced": "2.14"
        },
        {
            "last_affected": "2.14"
        },
        {
            "introduced": "2.16"
        },
        {
            "last_affected": "2.16"
        },
        {
            "introduced": "2.17.0"
        },
        {
            "last_affected": "2.17.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*
2.0
2.1
2.10
2.11
2.12
2.13
2.14
2.16
2.17.0
2.3
2.6
2.8
2.9
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.1
v2.12.0
v2.12.1
v2.13.0
v2.14.0
v2.14.0-beta.1
v2.14.1
v2.14.2
v2.15.0-beta.1
v2.15.2
v2.15.2-beta.1
v2.15.2-beta.2
v2.15.2-beta.3
v2.15.3
v2.15.4
v2.16.1
v2.16.1-beta.1
v2.17.0
v2.17.0-beta.1
v2.17.0-beta.2
v2.3.0
v2.6.1
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.7.6
v2.7.7
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7221.json"