Threat
Sentry MCP Server SSRF Exposes How Agent Trust Chains Become Attack Vectors
Publication date not yet evaluated · Added yahoo.com
Page published
Coverage timeline
Single-source incident — one report is available.
Why it matters
CVE-2026-81421 shows how an unvalidated tool argument in an MCP server turns the agent-to-server trust chain into an SSRF pivot past perimeter defenses, a pattern echoed by industry data showing large fractions of scanned MCP servers vulnerable to SSRF or lacking authentication.
CVE-2026-81421 is a Server-Side Request Forgery vulnerability in the raw_sentry_api component of the ddfourtwo/sentry-selfhosted-mcp Model Context Protocol server, reported by researcher cccccccti in GitHub issue #2. The raw_sentry_api tool passes a caller-controlled endpoint argument directly to Axios without validation, so an attacker can force the MCP server to make requests to arbitrary internal destinations (e.g. http://127.0.0.1:8000/ssrf-proof); a public exploit exists and Tenable rates it CVSS 7.3 while researchers suggest 9.0. Because agents trust MCP servers and MCP servers trust the internal network, the flaw bridges an external agent to internal infrastructure and enables lateral movement.