PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7221 TencentCloudBase CVE debrief

A server-side request forgery vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. The open-url API Endpoint's function openUrl in mcp/src/interactive-server.ts is affected by manipulating the req.body.url argument. This issue can be addressed by upgrading to version 2.17.1. The patch is identified as 3f678a1e7bd400cd76469d61024097d4920dc6b5. Users should review their deployments and apply the patch or upgrade.

Vendor
TencentCloudBase
Product
CloudBase-MCP
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-28
Original CVE updated
2026-07-24
Advisory published
2026-04-28
Advisory updated
2026-07-24

Who should care

Users of TencentCloudBase CloudBase-MCP up to 2.17.0 should be aware of this server-side request forgery vulnerability and take steps to upgrade to version 2.17.1. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams responsible for reviewing and applying patches or mitigating controls.

Technical summary

The TencentCloudBase CloudBase-MCP up to 2.17.0 contains a server-side request forgery vulnerability in the open-url API Endpoint. Specifically, the function openUrl in mcp/src/interactive-server.ts is vulnerable to manipulation of the req.body.url argument. This issue has been addressed in version 2.17.1 with patch 3f678a1e7bd400cd76469d61024097d4920dc6b5. The vulnerability allows for remote attacks and has been made public. Users should review their deployments and apply the patch or upgrade to mitigate the risk.

Defensive priority

Medium priority given the CVSS score of 5.5 and the availability of a patch. Defenders should prioritize based on exposure and asset criticality, focusing on high-risk deployments first. Compensating controls and monitoring should be considered for exposed systems while remediation is scheduled and verified. Exceptions and retesting of remediated assets should be tracked, and items should only be closed after evidence of successful remediation is documented. Security teams should also review relevant logs for exposed assets that need extra review to ensure thorough vulnerability management.

Recommended defensive actions

  • Upgrade TencentCloudBase CloudBase-MCP to version 2.17.1 or later
  • Apply patch 3f678a1e7bd400cd76469d61024097d4920dc6b5
  • Restrict access to the open-url API Endpoint
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-28T04:16:26.880Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected scope and vendor guidance with official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7221 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7221

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7221 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7221

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.