CVE-2026-65056: mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal netw

mcp-webresearch version 0.1.7 has a server-side request forgery vulnerability (SSRF, where a server can be tricked into accessing internal network services it shouldn't). An attacker can use prompt injection (hiding malicious instructions in text sent to the AI) to trick the AI into visiting internal network addresses, allowing the server to expose sensitive information like credentials from cloud metadata services (systems that store configuration and authorization data for cloud instances).