"MCP fURI" + CVE-2026-26118: Microsoft MarkItDown MCP SSRF to AWS Cloud Takeover
CVE-2026-26118 is a critical-severity server-side request forgery issue in MarkItDown MCP server, a MCP server. Affected: MarkItDown MCP server (all versions pre-patch).
Is MarkItDown MCP server running on your developers' machines? Anomity finds every device with this MCP server installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
CVE-2026-26118- Severity
- critical
- Attack type
- Server-side request forgery
- Component
- MarkItDown MCP server · MCP server
- Known exploited
- No known exploitation
- Published
- Last verified
What is CVE-2026-26118?
Microsoft's MarkItDown MCP server placed no restrictions on the URI passed to convert_to_markdown, allowing any caller to reach internal HTTP resources including the AWS EC2 instance metadata service and retrieve access keys sufficient for full cloud account takeover. BlueRock Security scanned 7,000+ live MCP servers and found 36.7% shared the same SSRF exposure; Microsoft patched a related Azure MCP variant in March 2026 Patch Tuesday.
Affected versions
| Affected | Fixed in |
|---|---|
MarkItDown MCP server (all versions pre-patch) | No fixed version listed |
Am I affected by CVE-2026-26118?
You are affected if you run MarkItDown MCP server (all versions pre-patch).
How do I fix CVE-2026-26118?
Update MarkItDown MCP server to patched version. Block MCP server access to cloud metadata endpoints (169.254.169.254). Restrict URI schemes to https:// only in MCP tool inputs.
How do I find every machine running MarkItDown MCP server?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MarkItDown MCP server and which version, then enforce a policy on it.