Skip to content

VSRVibe Security Radar

Findings Trends How we verify

Loading case details…

Vibe Security Radar

A mechanism-level study of vulnerabilities contributed by AI-written code. Each finding connects an advisory to the relevant change, residual vulnerability, and security fix.

Sources: first-party security advisories · public Git history · release artifacts

Data through Sep 26, 2026

By AI tool

Claude
GitHub Copilot
Cursor
ChatGPT/Codex

By root cause

Authentication & access control
Injection & unsafe execution
SSRF & network boundaries
Path & link handling
Validation & fail-open logic
Resource abuse & availability

Project

GitHub Data (CSV)Atom feed Contact

Findings/Root cause/SSRF & network boundaries

SSRF & network boundaries in AI-generated code

Unsafe URL parsing, redirects, proxying, credential forwarding, or destination checks allow unintended network access or trust-boundary crossing. 35 published CVEs and GitHub advisories in this category trace back to an AI-assisted code change, across 21 projects.

Findings: 35; 12% of all 284
Projects: 21; Most: mervinpraison/praisonai (5)
Critical or high: 6; of 16 with a severity score
Latest advisory: Aug 25, 2026; Data through Sep 26, 2026

Search and filter these findings →

Findings per month

9

May 2025Peak advisory month: Jul 2026Sep 2026

By advisory publication month. The latest month is partial.

AI tools

Which AI tool made the contributing change.

Claude30
Cursor2
GitHub Copilot2
ChatGPT/Codex1

How AI contributed

Whether the AI-assisted change introduced the flaw, widened exposure, or left a fix incomplete.

Direct introduction23
Flawed AI-written code7
Incomplete remediation4
New attack surface1

Languages

Primary language of the affected repository.

TypeScript13
Python12
JavaScript5
Go4
Ruby1

All 35 findings

Newest first

PraisonAI checked literal IP addresses without resolving ordinary hostnames before Spider requests. The repair checks DNS results for blocked addresses and rejects resolution failures.
HighCVE-2026-55526Aug 25, 2026mervinpraison/praisonaiPythonClaudeDirect introductionSSRF & network boundaries
An AI-assisted webhook request/test component adds response readback to an earlier outbound-request primitive. The shipped SQL-backed test path can cross the intended destination boundary when an admitted client can configure and test webhooks.
CriticalCVE-2026-64849Aug 17, 2026mlflow/mlflowPythonClaudeFlawed AI-written codeSSRF & network boundaries
AI-written code stored unvalidated caller-supplied webhook URLs and fetched them server-side, enabling SSRF against internal services.
CVE-2026-19340Aug 9, 2026anubissbe/projecthub-mcpTypeScriptClaudeDirect introductionSSRF & network boundaries
n8n's personal-agent SearXNG fallback bypassed its configured SSRF policy. The repair injects the policy-aware web-search transport into the agent runtime and routes the SearXNG tool through the node request helper.
MediumCVE-2026-77085Aug 5, 2026n8n-io/n8nTypeScriptCursorFlawed AI-written codeSSRF & network boundaries
An AI-assisted change let a connecting client pick the Consul API address with a request header, so the server could be pointed at an attacker-controlled endpoint and send along the Consul token it was configured with.
CVE-2026-16328Jul 29, 2026hashicorp/consul-mcp-serverGoGitHub CopilotDirect introductionSSRF & network boundaries
AI-written TerraformContextMiddleware trusted a client-supplied TFE_ADDRESS, redirecting server-side Terraform API requests and leaking the Terraform token to attackers.
CVE-2026-14869Jul 28, 2026hashicorp/terraform-mcp-serverGoGitHub CopilotFlawed AI-written codeSSRF & network boundaries
Claude-coauthored code put an unvalidated region into an upstream hostname, letting an authenticated caller send a Kiro API key to an attacker-controlled server.
MediumCVE-2026-56678Jul 10, 2026decolua/9routerJavaScriptClaudeDirect introductionSSRF & network boundaries
The AI-written code installed a custom ReadFromURIFunc in loadFromGitRevision that bypassed kin-openapi's external-ref policy, allowing SSRF and local file reads when --allow-external-refs=false.
CVE-2026-53508Jul 7, 2026oasdiff/oasdiffGoClaudeDirect introductionSSRF & network boundaries
AI-written code prefetched remote images using a single hostname validation before re-resolving DNS, allowing SSRF via DNS rebinding to internal resources.
CVE-2026-56676Jul 7, 2026decolua/9routerJavaScriptCursorFlawed AI-written codeSSRF & network boundaries
The Claude Opus 4.6 (1M context) co-authored change introduced the unbounded data: URI allowance in assertSecureUrl, which let secureFetch decode inputs of any size.
MediumGHSA-2944-57XV-2682Jul 2, 2026asymmetric-effort/specifyjsTypeScriptClaudeDirect introductionSSRF & network boundaries
A Claude-assisted change wrote an HTTPS-only URL guard that silently returned when a URL failed to parse, so the protocol and host checks were skipped for such input.
CVE-2026-50288Jul 2, 2026asymmetric-effort/specifyjsTypeScriptClaudeDirect introductionSSRF & network boundaries
The Claude Opus 4.6 co-authored change introduced secureFetch, which validated only the initial URL and then followed redirects, allowing a 3xx to an unchecked plaintext or internal target.
MediumGHSA-J5QP-P44G-2M49Jul 2, 2026asymmetric-effort/specifyjsTypeScriptClaudeDirect introductionSSRF & network boundaries
AI-written code removed URL validation from the test-downloader endpoint, enabling unauthenticated SSRF probes of internal services.
MediumCVE-2026-59101Jul 2, 2026estrellaxd/auto_bangumiPythonClaudeDirect introductionSSRF & network boundaries
The Claude Code session introduced catalog-derived paid tools without spending limits, an unauthenticated HTTP transport on all interfaces, and unvalidated catalog server URLs.
GHSA-RP72-5V5Q-2446Jun 26, 2026morganoncode/cardano402TypeScriptClaudeDirect introductionSSRF & network boundaries
Claude Opus 4.6 co-authored changes introduced the vulnerable behavior by loading the working-directory .env at import with execution-routing keys unfiltered and by spawning a committed MCP roster from the working directory.
CVE-2026-66065Jun 19, 2026q00/ouroborosPythonClaudeDirect introductionSSRF & network boundaries
A change generated with Claude Code introduced the searxng_search tool whose model-settable searxng_url goes straight to requests.get, creating the server-side request forgery.
CVE-2026-57143Jun 18, 2026mervinpraison/praisonaiPythonClaudeDirect introductionSSRF & network boundaries
Claude-bot code checked SSRF targets without DNS resolution, so hostnames resolving to private, loopback, or metadata addresses could bypass the guard.
CVE-2026-57126Jun 18, 2026mervinpraison/praisonaiPythonClaudeDirect introductionSSRF & network boundaries
Crawl4AI sent webhooks to caller-supplied URLs without validating their destination. The repair validates each webhook destination immediately before sending and disables redirects.
CriticalCVE-2026-56261Jun 16, 2026unclecode/crawl4aiPythonClaudeDirect introductionSSRF & network boundaries
Cursor-assisted SSRF validation blocked only literal loopback names, so alternate IP encodings could reach internal services.
MediumCVE-2026-47390May 29, 2026mervinpraison/praisonaiPythonClaudeIncomplete remediationSSRF & network boundaries
AI-written code added a string-only guard that missed URI objects, allowing protocol-relative host override to leak connection-scoped headers to an attacker-controlled host.
LowCVE-2026-33637May 18, 2026lostisland/faradayRubyClaudeIncomplete remediationSSRF & network boundaries
A change generated with Claude Code added the TestWebhook handler and read-back logic, extending an existing human-written blind SSRF in webhook delivery so callers could also read internal HTTPS responses.
CVE-2026-2393May 11, 2026mlflow/mlflowTypeScriptClaudeFlawed AI-written codeSSRF & network boundaries
The AI-created n8n API client inserted caller-controlled resource IDs directly into URL path segments without validation or encoding.
HighGHSA-8G7G-HMWM-6RV2May 8, 2026czlonkowski/n8n-mcpJavaScriptClaudeDirect introductionSSRF & network boundaries
Claude-assisted SSRF hardening blocked common private addresses but missed IPv6 ranges that tunnel or translate to internal IPv4 networks. A publisher-controlled domain could still steer namespace verification to protected services.
MediumCVE-2026-44430May 8, 2026modelcontextprotocol/registryGoClaudeIncomplete remediationSSRF & network boundaries
AI-written URL validation using only urlparse allowed a backslash-smuggled URL, enabling SSRF to internal hosts via requests.
CVE-2026-44335May 6, 2026mervinpraison/praisonaiPythonClaudeFlawed AI-written codeSSRF & network boundaries
During a view migration written with Claude Code, a change co-authored by Claude Opus 4.6 copied the SAML metadata fetch logic, including its unvalidated requests.get call, verbatim from earlier human-written platform code, carrying the pre-existing SSRF flaw into edx-enterprise.
CVE-2026-42860May 5, 2026openedx/edx-enterprisePythonClaudeFlawed AI-written codeSSRF & network boundaries
n8n-mcp could connect to an address different from the one checked by its URL validation. The repair pins the HTTP client to the validated address and disables redirect following.
HighCVE-2026-44694May 4, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionSSRF & network boundaries
An AI-assisted security patch added a synchronous SSRF check that covered hostnames and IPv4 ranges but omitted private and IPv4-encoding IPv6 forms.
CVE-2026-42449Apr 30, 2026czlonkowski/n8n-mcpTypeScriptClaudeIncomplete remediationSSRF & network boundaries
AI-written code used an unvalidated req.query.base_url to build a server-side fetch URL, enabling unauthenticated SSRF to internal and cloud-metadata endpoints.
CVE-2026-7147Apr 27, 2026joecastrom/mcp-chat-studioJavaScriptClaudeDirect introductionSSRF & network boundaries
AI-written code trusted a CDP /json/version webSocketDebuggerUrl without re-validating its host, allowing a second-hop SSRF-style pivot to untrusted targets.
MediumCVE-2026-43576Apr 17, 2026openclaw/openclawJavaScriptClaudeNew attack surfaceSSRF & network boundaries
AI-written code trusted the user-supplied instance-URL header to direct server-side requests, enabling authenticated SSRF in multi-tenant HTTP mode.
CVE-2026-39974Apr 8, 2026czlonkowski/n8n-mcpTypeScriptClaudeDirect introductionSSRF & network boundaries
Claude-coauthored proxy code could treat a crafted path as a new host and forward the application's Clerk secret key to that host.
CVE-2026-34076Mar 27, 2026clerk/javascriptTypeScriptClaudeDirect introductionSSRF & network boundaries
Code written with Claude Code introduced the beta OAuth consent flow whose credential check fetches a user-supplied Home Assistant URL without validation, and a later Claude Sonnet 4.5 change added forgeable tokens that extended the flaw to REST and WebSocket calls.
MediumCVE-2026-32111Mar 12, 2026homeassistant-ai/ha-mcpPythonClaudeDirect introductionSSRF & network boundaries
An AI-assisted change added an OAuth consent form that wrote the client name, client id, redirect URI, state and error text into HTML through Python f-strings, so a registration an attacker controls could run script in the browser of the operator who opens the page.
CVE-2026-32112Mar 12, 2026homeassistant-ai/ha-mcpPythonChatGPT/CodexDirect introductionSSRF & network boundaries
AI-written code fetched Feishu media from attacker-controlled URLs without SSRF checks, enabling internal requests and exfiltration as re-uploaded media.
HighCVE-2026-28451Feb 18, 2026openclaw/openclawTypeScriptClaudeDirect introductionSSRF & network boundaries
Claude-coauthored Control UI code auto-connected to a gateway URL from a crafted link, sending the user's stored gateway token to an attacker.
CVE-2026-25253Feb 2, 2026openclaw/openclawTypeScriptClaudeDirect introductionSSRF & network boundaries