gemini-cli patches SSRF flaw in MCP OAuth metadata discovery flows
josebalius · ghdev · 2026-08-25
Google's gemini-cli received a security PR fixing SSRF risks in MCP OAuth metadata discovery, dynamic client registration, and token exchange/refresh flows.
Attack vector: a malicious remote MCP server could use unvalidated WWW-Authenticate challenges or authorizationservers URLs to make the client issue requests to internal IPs, localhost, or cloud metadata services (169.254.169.254).
Key protections:
- Enforce HTTPS for remote endpoints per RFC 9728 §7.7 / RFC 8414 (HTTP only for loopback with local MCP servers)
- Origin matching for resourcemetadata challenges
- Block private IPv4/IPv6, loopback, link-local/IMDS, benchmark, and multicast ranges
- Async DNS resolution to prevent DNS rebinding
- Validate registration/token endpoints before requests, plus comprehensive test coverage
More from coding & agent
- Firecrawl CTF V3 launches: Solve 60 agent problems in 4 seconds each — devdigest · 2026-08-26
- Tested: Replacing Prompts with 'Genomes' for LLM Agents — MonokoEloba · 2026-08-26
- OpenWiki introduces self-correcting memory to handle stale knowledge — LangChain · 2026-08-26
- Higgsfield lands in Blender: prompt the scene, animate the camera, reblock in seconds — petewoodbridge · 2026-08-26
- OpenBaud: A FOSS MCP server for auditable serial hardware access — OneMasterpiece1717 · 2026-08-26
- Proposal: Force humans to sign and describe manual PRs — sh_reya · 2026-08-26