CVE-2026-19984

Name of the Vulnerable Software and Affected Versions jkawamoto mcp-florence2 versions prior to 0.3.14

Description A flaw in the get images() function within the src/mcp florence2/ init .py file allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the src argument and can be initiated remotely.

Recommendations Route all HTTP(S) requests through an SSRF-safe proxy server to mitigate the risk.