Where Can Your MCP Tools Connect? Lessons from Google and Weaviate Fixes

Governance Watch

In May 2026, independent security researcher Syed Anas Mohiuddin published a hypothesis about Model Context Protocol servers: that the industry ships them on a quiet assumption — data crossing the MCP boundary is trusted because it came from inside the system. His October update, "Protocol Pivoting, Four Months Later", tests that hypothesis against what changed [1].

What the public records and researcher update show

• Google — CVE-2026-14540. Google's CNA entry on NVD gives a CVSS 4.0 score of 8.0, high severity, and was published on 30 July 2026 (per the NVD record itself; a researcher-published date of 31 July is not used) [3]. Per the researcher's update, the fix validates resolved IP addresses at connection time [1].
• Weaviate — PR #12961, merged 7 September 2026 into the stable/v1.37 line, restricting Google-module endpoint fields to Google API hosts. The merge is recorded in the PR; the first release containing the fix is not inferred here [4].
• France's DINUM — PR #126, "harden SSRF on external APIs", merged 4 September 2026, in the official data.gouv.fr MCP server (per the researcher's update) [1].
• Tangerang City government, Indonesia — advisory GHSA-pw2j-pj4h-f5vg (high), published 3 September 2026, one day after the report (per the researcher's update) [1].

These fixes were confirmed March–September 2026. They are not a run of new October breaches.

A related Rapid7 finding, CVE-2026-97228, is low severity and not SSRF. The researcher also reports findings in US federal MCP servers — including a Department of Veterans Affairs benefits-claims server that logs full upstream response bodies at ERROR level, unredacted — and in Japan's Digital Agency. Those are still in triage and presented as unconfirmed, as is the researcher-reported JPMorgan Chase item, which has no public fix artifact and is excluded from this article's verified record. Reports in Japan also fall outside this episode's scope.

What the bug actually is

Be precise, because aggregator posts were not. This is not the MCP protocol breaking. It is an implementation pattern: a server builds an outbound request from data an agent supplied, without validating where that data actually resolves — server-side request forgery, reachable through the agent's tool arguments. A second pattern is upstream failure data, which can contain personal information, written to centralised logs unredacted.

The researcher's broader thesis, "Protocol Pivoting", is about chained agent protocols being pivoted across trust boundaries. He is explicit that it does not depend on SSRF — SSRF is one concrete way to get an outbound request from a privileged position. Treat the thesis as the researcher's analysis; the confirmed fixes above are the verified part.

Why your scanner misses it

Dependency-focused checks can miss a weakness reached through an agent’s tool arguments. The researcher argues that these tool-facing trust boundaries need separate inspection [1]. Check the actual request handling and permitted destinations, not only the dependency list.

Working practice, not a compliance checklist

• Inventory every MCP server your agents can reach, including internal forks.
• Patch: validate resolved IPs at connection time, disable or validate redirects, apply the same allowlist to every fetching tool, redact upstream bodies before logging.
• Restrict the network those servers can talk to. This remains your job regardless of any governance layer.
• Separately, treat the business side-effect — a write, a send, a deploy — as its own decision: what is allowed, who approves, what record proves it.

Where HaltState fits — and where it doesn't

HaltState checks connected business actions: policy checks before execution, human approval where required, signed evidence of decisions. It does not patch SSRF, it is not a vulnerability scanner, and it does not replace host security, network isolation or destination access controls — the current product page says exactly that [2]. Server patching and network restrictions stay with you; the governance layer governs what the agent may do next.

General information only. This article and its companion video are not legal advice.