Threat · curated 12 Sep 2026

Sentry MCP Server SSRF Exposes How Agent Trust Chains Become Attack Vectors

First reported today yahoo.com

Coverage timeline

Single-source incident — first reported, latest, and curated coincide.

Why it matters

CVE-2026-81421 shows how an unvalidated tool argument in an MCP server turns the agent-to-server trust chain into an SSRF pivot past perimeter defenses, a pattern echoed by industry data showing large fractions of scanned MCP servers vulnerable to SSRF or lacking authentication.

CVE-2026-81421 is a Server-Side Request Forgery vulnerability in the raw_sentry_api component of the ddfourtwo/sentry-selfhosted-mcp Model Context Protocol server, reported by researcher cccccccti in GitHub issue #2. The raw_sentry_api tool passes a caller-controlled endpoint argument directly to Axios without validation, so an attacker can force the MCP server to make requests to arbitrary internal destinations (e.g. http://127.0.0.1:8000/ssrf-proof); a public exploit exists and Tenable rates it CVSS 7.3 while researchers suggest 9.0. Because agents trust MCP servers and MCP servers trust the internal network, the flaw bridges an external agent to internal infrastructure and enables lateral movement.