The researcher's pinned analysis traces an agent-invoked zotero_add_by_url through its non-DOI, non-arXiv branch to _fetch_embedded_metadata. That function issues a Requests GET without filtering loopback, private or link-local destinations and without disabling automatic redirects. An adversary can put a deceptive import instruction in material that an…
Case · DiggingBeagle record
zotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583)
A reported SSRF in zotero-mcp 0.10.0 through 0.14.1 lets an agent-reachable generic webpage import fetch unchecked URLs and redirects. This is separate from a June 2026 OA-PDF SSRF that the maintainer fixed.
Scope
zotero-mcp versions 0.10.0 through 0.14.1 in VulnCheck CNA scope. Relevant flow requires zotero_add_by_url to be available, an authorized writable Zotero backend, a caller-supplied or model-chosen generic URL and reachability from the MCP host to the destination. Read-only setups do not traverse the reported path.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- not established
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The original researcher and CNA describe a plausible generic metadata-fetch SSRF path and a local example, but the write-up expressly stops short of an end-to-end private-network SSRF or model-driven exploit. Its impact is limited by tool availability, a writable backend, host network reachability, parsed citation-tag readback and subsequent item retrieval. The source-level code path was not independently reproduced in a controlled runtime, so exploitation remains not established and evidence grade conservative. Separate network-egress controls and destination/redirect validation are available, but a fixed October-path release was not verified.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ZOTERO-GENERIC-SINK · CLM-ZOTERO-READBACK-BOUND · CLM-ZOTERO-REPRO-BOUNDARY · CLM-ZOTERO-PRIOR-FIX · HaiND: zotero-mcp generic webpage metadata SSRF · CVE-2026-108583: zotero-mcp SSRF in zotero_add_by_url · zotero-mcp issue 326 and maintainer remediation of OA-PDF SSRF
At a glance
The maintained PDF-path guard was real, but it did not cover a separate generic metadata fetch. Security review must enumerate reachable sinks, rather than inferring protection from one fixed code path.
Read the implicationsNo independently verified fixed version for the generic URL sink was established. No field exploitation or cloud-metadata credential disclosure was demonstrated in reviewed evidence. The frequency of writable Zotero MCP deployments with access to sensitive internal networks is unknown.
Limits and uncertaintyFull account
The researcher's pinned analysis traces an agent-invoked zotero_add_by_url through its non-DOI, non-arXiv branch to _fetch_embedded_metadata. That function issues a Requests GET without filtering loopback, private or link-local destinations and without disabling automatic redirects. An adversary can put a deceptive import instruction in material that an assistant reads, but the actual network request still depends on the assistant invoking the exposed tool and a writable Zotero backend being configured.
The resulting read channel is narrower than unrestricted HTTP response access. According to the original report, the tool parses recognized citation meta-tags and saves them to Zotero, where a later item-metadata call may retrieve them. The record does not demonstrate arbitrary secret disclosure or real-world compromise. The October 10 CNA entry identifies CVE-2026-108583, affected versions and separate CVSS v4.0 and v3.1 ratings. The underlying GitHub call-site was cited in the reporter's write-up, but its relevant lines were not independently extracted in this research pass.
The history matters. In June issue 326, a different open-access PDF fetch path reached an unvalidated URL. The maintainer reported that PRs 327 and 328 fixed that path, including private-host and redirect checks. The newly reported generic metadata flow bypasses that separate guard; it does not show that the June fix was reverted. A shared destination validation policy across agent-reachable fetch paths would address the class more directly than repairing one tool at a time.
Mechanism and trust boundary
- 01
Untrusted instruction reaches agent
A document or task suggests adding an attacker-chosen reference URL to Zotero.
Boundary: untrusted retrieved content to tool selection
- 02
Authorized MCP tool makes unchecked request
zotero_add_by_url uses the generic webpage metadata branch and follows initial or redirected destinations without a private-host guard.
Boundary: agent argument to MCP host network authority
- 03
Limited metadata readback
Any recognized citation tags may be stored in a Zotero item and become readable to the agent; raw response disclosure was not demonstrated.
Boundary: internal HTTP response to citation metadata store
Timeline
- Oct 10, 2026disclosure
Public disclosure
Claims & evidence
CLM-ZOTERO-AFFECTEDVulnCheck published CVE-2026-108583 on October 10, 2026 for zotero-mcp 0.10.0 through 0.14.1, classifying the issue as CWE-918 with CVSS v4.0 2.3 and CVSS v3.1 4.2.supported
Basis: reported finding
- supportsCVE-2026-108583: zotero-mcp SSRF in zotero_add_by_urlprimary disclosure
CVE_RECORD.cveMetadata; containers.cna.affected, problemTypes and CVSS metrics
CLM-ZOTERO-PRIOR-FIXA separate June 8, 2026 issue described an SSRF in the DOI open-access PDF download path; the zotero-mcp maintainer stated that PR 327 added destination validation and per-hop redirect checks and closed that issue. The October generic metadata path is a different fetch sink.supported
Basis: reported finding
- supportszotero-mcp issue 326 and maintainer remediation of OA-PDF SSRFprimary disclosure
Issue #326, first SSRF section and maintainer June 8 comment listing fixes from PR #327
- supportsHaiND: zotero-mcp generic webpage metadata SSRFprimary disclosure
Root cause section 5 and References identifying the already guarded PDF path
CLM-ZOTERO-GENERIC-SINKNguyen Dinh Hai reports that zotero_add_by_url invokes _fetch_embedded_metadata for generic webpages and fetches the supplied URL using requests.get without private-destination validation or redirect re-checks.supported
Basis: reported finding
- supportsHaiND: zotero-mcp generic webpage metadata SSRFprimary disclosure
Root cause sections 1-3, _fetch_embedded_metadata at write.py:2035-2090
- supportsCVE-2026-108583: zotero-mcp SSRF in zotero_add_by_urlprimary disclosure
CNA description of the generic metadata fetch; distinct from June issue 326
CLM-ZOTERO-READBACK-BOUNDThe described SSRF is conditional on an exposed write-capable Zotero tool and reachable destination; the potential readback is limited to parsed citation metadata rather than arbitrary raw HTTP response bodies, and no end-to-end hostile agent compromise is established.supported
Basis: reported finding
- supportsHaiND: zotero-mcp generic webpage metadata SSRFprimary disclosure
Summary, Attack flow, Impact and limits; writable-client gate and recognized citation meta-tags
CLM-ZOTERO-REPRO-BOUNDARYThe original researcher characterizes the investigation as source-level and says it did not execute an end-to-end SSRF against private network services; the published write-up contains a local loopback example, so no broader exploit outcome should be inferred.supported
Basis: reported finding
- supportsHaiND: zotero-mcp generic webpage metadata SSRFprimary disclosure
Verification section and Impact and limits; local example and no end-to-end SSRF caveat
Implications
The maintained PDF-path guard was real, but it did not cover a separate generic metadata fetch. Security review must enumerate reachable sinks, rather than inferring protection from one fixed code path.
Controls and mitigations
- Route every agent-reachable HTTP fetch through one destination guard that rejects non-public resolved addresses and independently checks each redirect hop.
- Test direct loopback, RFC1918, link-local and redirect-to-private cases for the generic metadata tool, not only for the older PDF path.
- Limit MCP tool grants and the MCP host's network reachability; input screening alone cannot enforce a network boundary.
Unknowns and contradictions
- No independently verified fixed version for the generic URL sink was established.
- No field exploitation or cloud-metadata credential disclosure was demonstrated in reviewed evidence.
- The frequency of writable Zotero MCP deployments with access to sensitive internal networks is unknown.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 126