# CVE-2026-26118: "MCP fURI" + CVE-2026-26118: Microsoft MarkItDown MCP SSRF to AWS Cloud Takeover

> CVE-2026-26118 is a critical-severity server-side request forgery issue in MarkItDown MCP server, a MCP server. Affected: MarkItDown MCP server (all versions pre-patch).

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-26118
- **Aliases:** ti-007
- **Severity:** critical
- **Attack type:** Server-side request forgery
- **Component:** MarkItDown MCP server (MCP server)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-01-20
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-26118

## Summary

Microsoft's MarkItDown MCP server placed no restrictions on the URI passed to convert_to_markdown, allowing any caller to reach internal HTTP resources including the AWS EC2 instance metadata service and retrieve access keys sufficient for full cloud account takeover. BlueRock Security scanned 7,000+ live MCP servers and found 36.7% shared the same SSRF exposure; Microsoft patched a related Azure MCP variant in March 2026 Patch Tuesday.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| MarkItDown MCP server (all versions pre-patch) | no fixed version listed |

## Am I affected by CVE-2026-26118?

You are affected if you run MarkItDown MCP server (all versions pre-patch).

## How do I fix CVE-2026-26118?

Update MarkItDown MCP server to patched version. Block MCP server access to cloud metadata endpoints (169.254.169.254). Restrict URI schemes to https:// only in MCP tool inputs.

## How do I find every machine running MarkItDown MCP server?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run MarkItDown MCP server and which version, then enforce a policy on it.

## References

- article: https://www.bluerock.io/post/mcp-furi-microsoft-markitdown-vulnerabilities
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-26118

## Related vulnerabilities

- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-103091](https://catalog.anomity.ai/vuln/cve-2026-103091) — critical
- [CVE-2026-104120](https://catalog.anomity.ai/vuln/cve-2026-104120) — medium
- [CVE-2026-19516](https://catalog.anomity.ai/vuln/cve-2026-19516) — critical
- [CVE-2026-15643](https://catalog.anomity.ai/vuln/cve-2026-15643) — medium
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-26118