gemini-cli patches SSRF flaw in MCP OAuth metadata discovery flows
josebalius · ghdev · 2026-08-25
Google's gemini-cli received a security PR fixing SSRF risks in MCP OAuth metadata discovery, dynamic client registration, and token exchange/refresh flows.
Attack vector: a malicious remote MCP server could use unvalidated WWW-Authenticate challenges or authorizationservers URLs to make the client issue requests to internal IPs, localhost, or cloud metadata services (169.254.169.254).
Key protections:
- Enforce HTTPS for remote endpoints per RFC 9728 §7.7 / RFC 8414 (HTTP only for loopback with local MCP servers)
- Origin matching for resourcemetadata challenges
- Block private IPv4/IPv6, loopback, link-local/IMDS, benchmark, and multicast ranges
- Async DNS resolution to prevent DNS rebinding
- Validate registration/token endpoints before requests, plus comprehensive test coverage
More from coding & agent
- A versioned bootstrap loader pattern for keeping AI-generated code always shippable — NickPassig · 2026-10-15
- Amazon blocks AI shopping agents; Maritime offers $1/month Android MCP workaround — Scobleizer · 2026-10-15
- Dev vibe-codes open-source newsletter platform, 83% cheaper than Beehiiv from $19/mo — marclou · 2026-10-15
- ERP AI launches Proto: 'headless SaaS' business software built for AI agents — Aiden_Tech_Ai · 2026-10-15
- Engineering managers need deep reading, not just agent summaries: 5 recommended resources — rseroter · 2026-10-15
- Adding motion graphics with just a prompt: the Claude Motion x ElevenLabs MCP workflow — CurieuxExplorer · 2026-10-15