arnav garg
← research

research · security

security research.

i look for bugs in open-source tools, mostly mcp servers, the tool servers ai agents use to reach files, browsers, databases and the network. this is only what's public.

advisories

  • fetch-mcp: ssrf through a redirect to a literal ip

    redirect hops to a literal ip skipped the ssrf checks, so any fetched page could bounce the server to cloud metadata and hand iam credentials to the model.

    GHSA-5rr2-84x3-mw4g · high 7.4 · fixed in 0.7.1

  • caddy-mcp: one call wipes the whole caddy config

    writing to the config root skipped the confirm step and was marked non-destructive, so a model could replace the live config without a human being asked.

    GHSA-6859-g3p8-jc93 · high 7.7 · fixed in 2.5.5

fixes merged upstream