PatchSiren cyber security CVE debrief
CVE-2026-7221 TencentCloudBase CVE debrief
A server-side request forgery vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. The open-url API Endpoint's function openUrl in mcp/src/interactive-server.ts is affected by manipulating the req.body.url argument. This issue can be addressed by upgrading to version 2.17.1. The patch is identified as 3f678a1e7bd400cd76469d61024097d4920dc6b5. Users should review their deployments and apply the patch or upgrade.
- Vendor
- TencentCloudBase
- Product
- CloudBase-MCP
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-28
- Original CVE updated
- 2026-07-24
- Advisory published
- 2026-04-28
- Advisory updated
- 2026-07-24
Who should care
Users of TencentCloudBase CloudBase-MCP up to 2.17.0 should be aware of this server-side request forgery vulnerability and take steps to upgrade to version 2.17.1. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams responsible for reviewing and applying patches or mitigating controls.
Technical summary
The TencentCloudBase CloudBase-MCP up to 2.17.0 contains a server-side request forgery vulnerability in the open-url API Endpoint. Specifically, the function openUrl in mcp/src/interactive-server.ts is vulnerable to manipulation of the req.body.url argument. This issue has been addressed in version 2.17.1 with patch 3f678a1e7bd400cd76469d61024097d4920dc6b5. The vulnerability allows for remote attacks and has been made public. Users should review their deployments and apply the patch or upgrade to mitigate the risk.
Defensive priority
Medium priority given the CVSS score of 5.5 and the availability of a patch. Defenders should prioritize based on exposure and asset criticality, focusing on high-risk deployments first. Compensating controls and monitoring should be considered for exposed systems while remediation is scheduled and verified. Exceptions and retesting of remediated assets should be tracked, and items should only be closed after evidence of successful remediation is documented. Security teams should also review relevant logs for exposed assets that need extra review to ensure thorough vulnerability management.
Recommended defensive actions
- Upgrade TencentCloudBase CloudBase-MCP to version 2.17.1 or later
- Apply patch 3f678a1e7bd400cd76469d61024097d4920dc6b5
- Restrict access to the open-url API Endpoint
- Monitor for suspicious activity
- Review compensating controls for exposed systems
- Track exceptions and retest remediated assets
Evidence notes
The CVE record was published on 2026-04-28T04:16:26.880Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected scope and vendor guidance with official sources.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-28T04:16:26.880Z and has not been modified since then. The NVD entry is currently Deferred.