Five Organizations, One Flaw: The Same MCP SSRF Bug Fixed at Google, JPMorgan and Two Governments
Posted on 6th Oct 2026 12:06:14 in Artificial Intelligence, Machine Learning
Tagged as: MCP, Model Context Protocol, SSRF, protocol pivoting, AI agent security, CVE-2026-14540, Google, JPMorgan, DINUM, cybersecurity
An independent researcher's 'Protocol Pivoting' update confirms the same SSRF flaw was fixed in MCP servers at five unrelated organizations - Google, JPMorgan, Weaviate, France's DINUM and Indonesia's Tangerang City - while five US federal agent servers remain in triage.
