GHSA-rp72-5v5q-2446: @cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

June 26, 2026

@cardano402/mcp-server versions <= 0.1.1 ship three security gaps that can lead to unauthorized fund movement when the package is used as designed (an MCP server exposing Cardano payment tools to an

References

github.com/MorganOnCode/cardano402/security/advisories/GHSA-rp72-5v5q-2446
github.com/advisories/GHSA-rp72-5v5q-2446

Code Behaviors & Features

Detect and mitigate GHSA-rp72-5v5q-2446 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →