CVE-2026-10280

A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack c...

CVE-2026-10280

Affected product: horizon921 mcpilot 0.1.0. The vulnerability is in the MCP API Call Endpoint, specifically the function in client/src/app/api/mcp/call/route.ts where manipulating the serverBaseUrl enables server-side request forgery (SSRF). Remote exploit disclosed publicly; the issue was report...