What is CVE-2026-25904?

CVE-2026-25904 is a medium-severity vulnerability, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.8/10. Published 2026-02-09.

How severe is CVE-2026-25904?

Medium severity. CVSS v3 base score is 5.8 out of 10.

CVE-2026-25904

CVE-2026-25904

The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-pytho…

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L.

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

reefs@jfrog.com

Frequently asked questions

What is CVE-2026-25904?: CVE-2026-25904 is a medium-severity vulnerability, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.8/10. Published 2026-02-09.
How severe is CVE-2026-25904?: Medium severity. CVSS v3 base score is 5.8 out of 10.