CVE-2026-19340 anubissbe CVE debrief

Who should care

Security teams responsible for anubissbe ProjectHub-Mcp instances should review and verify their inventory for affected versions. Security teams should also monitor for vendor remediation or patches and implement compensating controls to detect potential SSRF attacks. Vulnerability management and security teams should prioritize review of affected product deployments and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

A low-severity SSRF vulnerability was identified in anubissbe ProjectHub-Mcp up to 5.0.0. The vulnerability affects an unknown function in the backend-fix/complete_backend.js file of the Webhooks API component. The manipulation of the 'url' argument can cause a server-side request forgery. Remote exploitation is possible. Limited details are available about the vulnerability, and the project was informed early but has not responded yet. Security teams should prioritize review of affected product deployments and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Defensive priority

Low-priority defensive review recommended due to limited details and low CVSS score.

Recommended defensive actions

• Review and verify inventory for affected anubissbe ProjectHub-Mcp instances
• Implement compensating controls to detect potential SSRF attacks
• Monitor for vendor remediation or patches
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; verify affected scope and vendor remediation status. Monitor for potential SSRF attacks. The vulnerability affects an unknown function in the backend-fix/complete_backend.js file of the Webhooks API component. Limited details are available about the vulnerability, and the project was informed early but has not responded yet.

Official resources