The LudusMCP SSRF , documented as CVE-2026-19367 allows a remote user with access to the read_range_config to force the server to make requests to arbitrary addresses. The SecNews technical team is investigating the implications for installations connecting MCP clients to Ludus environments.
The CVE concerns version 1.0.24 of LudusMCP, a Model Context Protocol server for managing Ludus labs via natural language commands. The CVE Feed entry attributes the vulnerability to the src/tools/rangeConfig.ts file and the read_range_config component .
See also: claude-sesh tool: path traversal in Claude Code files
LudusMCP SSRF and the role of Source
According to the open issue on GitHub, the tool accepts the source and, when it starts with http:// or https://, directly calls the fetch. The response content is then returned to the MCP client, without any socket checking.
This behavior turns LudusMCP SSRF into a request mechanism from the server's location rather than the user's computer. The report describes a test with a local address, in which the server received a GET request and the response body was successfully returned to the caller.
The problem is not theoretically limited to 127.0.0.1. If the LudusMCP server has access to private subnets, management services, or cloud infrastructure metadata endpoints, an MCP user may attempt to reach them via the same operation. The exact result depends on the network topology and permissions of the installation.
What CVE-2026-19367 means for installations
The CVE entry assigns the issue CWE-918 and a CVSS score of 3.1 6.5, with low privileges required and no user interaction. The attack can be launched remotely, but requires access to a function exposed by the tool, and the impact is affected by the networks the server has access to.
LudusMCP is typically installed on a device running an MCP client, such as Claude Desktop, and connects to a Ludus server via WireGuard or SSH. This architecture means that exposure can involve not only the tool itself, but also internal services visible to the device running the MCP server.
As of this writing, no fix or official response to the issue has been published. The CVE Alert states that the project manager has been notified, but does not list a fix available. The absence of a fix should be considered a temporary situation and not an indication that all installations are equally vulnerable.
See also: SiYuan: Vulnerability exposes MCP tools and workspace
Temporary defense against LudusMCP SSRF
Administrators should temporarily restrict read_range_config URLs to strictly necessary and trusted destinations, as the feature cannot be disabled. In addition, loopback addresses, private networks, link-local connections, multicast, and cloud metadata endpoints should be blocked before each request.
Protection should include DNS resolution and checking the real address before connecting, as well as double-checking each destination in redirects. The SecNews technical team also recommends logging requests, restricting network access to the MCP server, and reviewing the users who have access to the tool.
These controls also need to be implemented at the infrastructure level, because a secure MCP client configuration is not enough if the server can communicate unhindered with internal networks. Monitoring unusual URLs, failed requests, and redirects can help detect an exploit attempt.
The report of CVE-2026-19367 shows why MCP tools that read remote content need clear network boundaries and strict login validation. Until an official fix is available, isolating LudusMCP and disabling non-essential source URLs reduces the risk of internal data leakage.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: CoreBreak: Critical vulnerabilities in AI agents and cloud infrastructure
