Four vendors, one bad assumption: SSRF in MCP servers

There is a particular kind of bug that you only recognize the third time you see it. The first time, it looks like a mistake. The second time, it looks like a coincidence. By the third time you stop looking at the code and start looking at the people who wrote it, because the bug is no longer in the code. It is in an assumption everyone shared.... Weiterlesen