CVE-2026-81421CWE-918ssrf

CVE-2026-81421

High · published August 27, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00495 · 41.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-27T05:18Z
References (6)
https://github.com/ddfourtwo/sentry-selfhosted-mcp/ · [email protected]https://github.com/ddfourtwo/sentry-selfhosted-mcp/issues/2 · [email protected]https://vuldb.com/cve/CVE-2026-81421 · [email protected]https://vuldb.com/submit/887100 · [email protected]https://vuldb.com/vuln/395941 · [email protected]https://vuldb.com/vuln/395941/cti · [email protected]
EPSS history
Timeline
  • 28 AUG 06:54Z
    EPSS moved — → 0%
    epss
  • 26 AUG 23:45Z
    ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery
    cvelistv5