MCP fURI -- Microsoft MarkItDown MCP SSRF
Date: 2026-01
Affected: MCP fURI
Attack vector: ssrf
Category: real-world
Severity: Medium

Microsoft's MarkItDown MCP server allowed arbitrary URI calls with no boundaries. On AWS EC2 instances using IMDSv1, attackers could query instance metadata to obtain access/secret keys with potential full admin access. Researchers found ~36.7% of all MCP servers have similar SSRF exposure.


Mitigations:

Architectural layers (MAESTRO):