Zotero MCP server flaw lets prompt injection probe internal networks

A vulnerability in zotero-mcp, a Model Context Protocol server that connects AI agents to the Zotero reference manager, allows attackers to make the agent send requests to internal network addresses. The flaw was published as CVE-2026-108583 on 10 October 2026 and affects versions 0.10.0 through 0.14.1.

According to the National Vulnerability Database entry, the problem sits in a function called _fetch_embedded_metadata, which fetches URLs without validating where those URLs point. That is a server-side request forgery, or SSRF, weakness: the server can be tricked into making network requests on an attacker's behalf, from a position inside the network where the server runs.

The agentic angle is the delivery route. The NVD entry says attackers can steer the agent via prompt injection into calling the zotero_add_by_url tool. Prompt injection means hiding instructions in content the agent reads, so the model treats them as commands. In this case, the instruction the attacker wants is simple: add an item from a particular URL. The server then goes and fetches it.

Because there is no destination check, the resulting requests can reach loopback, private, or link-local hosts, the advisory says. Those address ranges typically host services that are never exposed to the public internet, such as local admin interfaces or cloud instance metadata endpoints. The NVD entry notes the requests can arrive at these hosts directly or via redirects, meaning a URL that looks external can bounce the fetch inwards.

The data an attacker gets back is limited but not nothing. According to the entry, the vulnerability leaks citation meta-tags and error details. In practice, that means whatever HTML metadata the internal page exposes, plus the text of any failures. Error messages and timing differences are often enough to map which internal services exist and which ports respond, even when the full response body is not returned.

The advisory references the specific lines of source code in the project's write.py file at version 0.14.1, an issue filed on the project's GitHub repository, a technical write-up on HackMD, and an advisory published by VulnCheck covering the same versions. The incident record derived from these sources lists the status as reported and the severity as moderate.

No fixed version is named in the NVD entry reviewed for this article, and the sources do not describe any exploitation in the wild. Users of zotero-mcp should check the project's GitHub issue and the VulnCheck advisory for current remediation guidance.

The pattern here is becoming familiar across MCP servers. A tool is written on the assumption that a human chooses the URL, so the only validation needed is whether the fetch succeeds. Once an agent is the caller, and once untrusted text can influence what the agent decides to do, that assumption collapses. Any tool that accepts a URL from the model is effectively accepting a URL from anyone whose content the model has read. Destination allowlists, blocks on private address ranges, and refusal to follow redirects into those ranges are the standard defences, and the absence of them is what the CVE describes.