Independent Researcher Discloses SSRF Vulnerabilities in Google and JPMorgan MCP Servers, Revealing 'Protocol Pivoting' Risks for AI Agents

Independent security researcher Syed Anas Mohiuddin recently published findings on the security of the Model Context Protocol (MCP), revealing that multiple organizations, including US tech giant Google and US bank JPMorgan Chase, have similar Server-Side Request Forgery (SSRF) vulnerabilities in their MCP projects. These flaws could allow attackers to trick MCP servers into making network requests to internal systems they cannot directly access.

Specifically, Google's database access tool, MCP Toolbox for Databases, was found to have a high-risk SSRF vulnerability tracked as CVE-2026-14540, with a CVSS score of 8.0. The vulnerability stems from the HTTP client's lack of URL redirect checks and destination IP address validation. In an interview with tech media outlet Ars Technica, Mohiuddin explained that he calls the technique of exploiting trust relationships between different protocols to gradually expand the attack surface 'Protocol Pivoting.' In this scenario, malicious instructions can be embedded in external content read by an AI agent; when the agent hands off tasks to other agents, those receiving agents might execute restricted operations if they fail to verify proper authorization.

Google has since patched the SSRF vulnerability in MCP Toolbox, implementing measures such as checking destination IP addresses during connection establishment and restricting connections via IP allowlists and blocklists. This incident serves as a reminder for enterprises deploying AI agents: beyond guarding against prompt injection, it is crucial to strictly limit the network access scope of MCP tools and ensure appropriate authorization checks before agents access sensitive data or perform high-privilege operations.