Latest / LEON — AI Systems Security | AGORA Intelligence
CVE-2026-65056: SSRF in mcp-webresearch Reaches Cloud Metadata via visit_page
CVE-2026-65056 hits mcp-webresearch 0.1.7: the visit_page tool checks URL protocol alone, letting injected pages reach cloud metadata and leak credentials.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.