CVE-2026-19339
Full vulnerability record from the local CVENow database.
Description
A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
2.1
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-08-09 07:17:04
Last modified
2026-10-23 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-19339",
"sourceIdentifier": "[email protected]",
"published": "2026-08-09T07:17:04.000",
"lastModified": "2026-10-23T20:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Se ha descubierto una falla de seguridad en aliyun alibabacloud-dataworks-mcp-server hasta la versión 1.0.43. El elemento afectado es la función ReadResourceRequestSchema del archivo src/resources/initResources.ts. La manipulación del argumento request.params.uri resulta en falsificación de petición del lado del servidor. El ataque puede ser lanzado de forma remota. El proyecto fue informado del problema con antelación a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "aliyun",
"product": "alibabacloud-dataworks-mcp-server",
"cpes": [
"cpe:2.3:a:aliyun:alibabacloud-dataworks-mcp-server:*:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "1.0.0",
"status": "affected"
},
{
"version": "1.0.1",
"status": "affected"
},
{
"version": "1.0.2",
"status": "affected"
},
{
"version": "1.0.3",
"status": "affected"
},
{
"version": "1.0.4",
"status": "affected"
},
{
"version": "1.0.5",
"status": "affected"
},
{
"version": "1.0.6",
"status": "affected"
},
{
"version": "1.0.7",
"status": "affected"
},
{
"version": "1.0.8",
"status": "affected"
},
{
"version": "1.0.9",
"status": "affected"
},
{
"version": "1.0.10",
"status": "affected"
},
{
"version": "1.0.11",
"status": "affected"
},
{
"version": "1.0.12",
"status": "affected"
},
{
"version": "1.0.13",
"status": "affected"
},
{
"version": "1.0.14",
"status": "affected"
},
{
"version": "1.0.15",
"status": "affected"
},
{
"version": "1.0.16",
"status": "affected"
},
{
"version": "1.0.17",
"status": "affected"
},
{
"version": "1.0.18",
"status": "affected"
},
{
"version": "1.0.19",
"status": "affected"
},
{
"version": "1.0.20",
"status": "affected"
},
{
"version": "1.0.21",
"status": "affected"
},
{
"version": "1.0.22",
"status": "affected"
},
{
"version": "1.0.23",
"status": "affected"
},
{
"version": "1.0.24",
"status": "affected"
},
{
"version": "1.0.25",
"status": "affected"
},
{
"version": "1.0.26",
"status": "affected"
},
{
"version": "1.0.27",
"status": "affected"
},
{
"version": "1.0.28",
"status": "affected"
},
{
"version": "1.0.29",
"status": "affected"
},
{
"version": "1.0.30",
"status": "affected"
},
{
"version": "1.0.31",
"status": "affected"
},
{
"version": "1.0.32",
"status": "affected"
},
{
"version": "1.0.33",
"status": "affected"
},
{
"version": "1.0.34",
"status": "affected"
},
{
"version": "1.0.35",
"status": "affected"
},
{
"version": "1.0.36",
"status": "affected"
},
{
"version": "1.0.37",
"status": "affected"
},
{
"version": "1.0.38",
"status": "affected"
},
{
"version": "1.0.39",
"status": "affected"
},
{
"version": "1.0.40",
"status": "affected"
},
{
"version": "1.0.41",
"status": "affected"
},
{
"version": "1.0.42",
"status": "affected"
},
{
"version": "1.0.43",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.1,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"baseScore": 6.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-10T13:43:17.339751Z",
"id": "CVE-2026-19339",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://github.com/aliyun/alibabacloud-dataworks-mcp-server/",
"source": "[email protected]"
},
{
"url": "https://github.com/aliyun/alibabacloud-dataworks-mcp-server/issues/27",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-19339",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/865263",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387175",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/387175/cti",
"source": "[email protected]"
}
]
}