PT-2026-35362 · Shadowclonelabs · Glutamatemcpservers

Brucejin · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7094

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ShadowCloneLabs GlutamateMCPServers versions up to e2de73280b01e5d943593dd1aa2c01c5b9112f78

Description A remote server-side request forgery (SSRF) exists in the puppeteer navigate component within the file src/puppeteer/index.ts. This issue occurs when the url argument is manipulated, allowing an attacker to induce the server to make unintended requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7094

Affected Products

Glutamatemcpservers

References · 11

• 🔥 https://github.com/BruceJqs/public_exp/issues/7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7094 · Security Note
• https://github.com/ShadowCloneLabs/GlutamateMCPServers/issues/8 · Note
• https://twitter.com/infoflowcloud/status/2048853904067100777 · Twitter Post
• https://t.me/CVEtracker/51903 · Telegram Post
• https://vuldb.com/submit/800725 · Note
• https://vuldb.com/vuln/359669 · Note
• https://twitter.com/VulmonFeeds/status/2048678853451674092 · Twitter Post
• https://github.com/ShadowCloneLabs/GlutamateMCPServers · Note
• https://twitter.com/CVEnew/status/2048852252605952072 · Twitter Post
• https://vuldb.com/vuln/359669/cti · Note