MCP Protocol Pivoting: Analyzing CVE-2026-97228 and Agent-to-Agent SSRF Risks

Seed story: "MCP for agent-to-agent comms may be the riskiest protocol you’ve never heard of" (Ars Technica) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

As the Model Context Protocol (MCP) solidifies its position as the standard for AI agent communication, independent researcher Syed Anas Mohiuddin has exposed a critical class of vulnerabilities that allow malicious prompts to propagate across disparate systems. By exploiting "protocol pivoting" to bypass trust boundaries, these flaws enable server-side request forgery (SSRF) attacks, a risk recently highlighted by CVE-2026-97228 in Google’s MCP toolbox. Developers integrating MCP into their architectures must now address these specific gaps, such as missing IP validation and redirect policies, to prevent unauthorized network requests from compromising internal endpoints.

The Discovery of Protocol Pivoting

Independent researcher Syed Anas Mohiuddin uncovered a critical flaw in the Model Context Protocol (MCP), a standard originally developed by Anthropic for AI agent communication. His analysis revealed that trust gaps within the protocol allow "protocol pivoting," a technique where malicious prompts propagate between agents using different communication channels. This vulnerability effectively turns the inter-agent communication layer into a vector for spreading harmful instructions.

The implications for developers are significant, as these trust gaps enable server-side request forgery (SSRF). By exploiting these weaknesses, attackers can coerce agents into making unauthorized network requests to internal endpoints. This shifts the security perimeter from the user interface to the backend infrastructure, meaning that even if an agent’s input is sanitized, the underlying protocol can still be manipulated to bypass standard controls.

Malicious prompts can spread between agents via protocol pivoting.
Trust gaps allow unauthorized internal network requests.
The attack vector bypasses traditional input validation.

CVE-2026-97228 and the Google MCP Toolbox

The severity 8 rating for CVE-2026-97228 highlights a critical gap in googleapis/mcp-toolbox. The core issue was the absence of robust IP validation and CheckRedirect policies. Without these safeguards, the toolbox could be manipulated into accepting unsafe base URLs, effectively bypassing intended network boundaries.

This implementation flaw allowed attackers to trigger server-side request forgery (SSRF) attacks. By exploiting the missing validation, malicious actors could force the agent to make unauthorized requests to internal endpoints. The risk was not merely theoretical; it demonstrated how a single missing check could compromise the entire communication layer.

To resolve this, Google implemented a multi-layered defense:

An allow-list of specific IP ranges.
Block lists to reject known unsafe addresses.
Startup validation to reject unsafe base URLs immediately.

For developers, this underscores that protocol adoption requires rigorous input validation. Trusting an agent’s internal routing without explicit IP checks creates a direct path to internal network exposure.

Cross-Platform Impact and Vendor Responses

The scope of the protocol pivoting flaw extends far beyond a single vendor, affecting a diverse array of high-profile systems. According to reports, the vulnerabilities were demonstrated across infrastructure used by JP Morgan Chase, Rapid7, Weviate, and even the French government’s interministerial digital directorate and the US federal government. This widespread impact highlights how deeply MCP has become embedded in critical enterprise and public sector workflows.

However, the response to these risks has been uneven. While Google’s MCP toolbox received a severity rating of 8 for CVE-2026-97228, Rapid7’s similar vulnerability was rated only 2.7. This disparity suggests that severity assessments may not always reflect the true operational risk in agent-to-agent environments.

Key implications for developers include:

Inconsistent Severity: Ratings vary significantly across vendors.
Broad Exposure: Both financial and government systems are affected.
Vendor-Dependent Fixes: Rapid7 patched the issue, but other systems may remain vulnerable.

Developers must audit their specific stack, as a low CVE score does not guarantee safety in complex agent architectures.

Mechanics of Agent-to-Agent SSRF

The core of this vulnerability lies in how MCP agents handle network instructions. By exploiting trust gaps, attackers can trigger server-side request forgery (SSRF), compelling agents to execute unauthorized network requests. This mechanism effectively bypasses standard security controls, allowing malicious prompts to direct traffic toward sensitive internal endpoints that should remain isolated from external inputs.

Key technical factors include:

Missing CheckRedirect policies that fail to validate destination URLs.
Absence of IP validation, permitting connections to private network ranges.
Protocol pivoting, which forwards malicious instructions across different communication channels.

For developers, this highlights a critical workflow risk. When integrating MCP into production systems, relying solely on the agent’s internal logic is insufficient. You must enforce strict network boundaries at the infrastructure level. Without these controls, your agent becomes a vector for internal reconnaissance, potentially exposing data that your application architecture was designed to protect.

Architectural Trust Boundaries in MCP

The Model Context Protocol, initially developed by Anthropic, has become the de facto standard for AI agent communication. However, its current architecture lacks inherent isolation between agents, creating a single point of failure for instruction integrity. Because the protocol assumes a trusted environment, it does not natively validate the origin or safety of instructions passed between components. This design gap allows "protocol pivoting," where malicious prompts exploit trust boundaries to spread across disparate systems.

For developers, this means standard integration patterns are insufficient. Without explicit boundaries, a compromised agent can act as a vector for server-side request forgery (SSRF), forcing other agents to make unauthorized network requests to internal endpoints. The vulnerability affects a wide range of implementations, including those used by Google, JP Morgan Chase, and the US federal government.

To secure production agents, teams must move beyond implicit trust. Key requirements include:

Implementing strict allow-lists for IP ranges.
Validating base URLs at startup to reject unsafe targets.
Enforcing explicit isolation between agent instances.

Mitigation Strategies for Production Agents

Securing MCP implementations requires hardening the network layer to prevent unauthorized internal access. Developers should enforce strict IP allow-lists and block lists to reject unsafe base URLs during startup, mirroring the fix Google applied to its MCP toolbox. This approach ensures that agents cannot be coerced into making requests to sensitive internal endpoints.

Key defensive practices include:

Validating all outbound connection targets against a predefined whitelist.
Implementing robust CheckRedirect policies to stop malicious redirects.
Rejecting configurations that permit broad or wildcard network access.

By treating the agent’s network interface as a critical trust boundary, teams can mitigate the risk of protocol pivoting. These controls transform passive vulnerabilities into active defenses, ensuring that even if a malicious prompt slips through, the underlying infrastructure remains secure.

FAQ

What is the security vulnerability in Google's MCP toolbox identified as CVE-2026-97228?

CVE-2026-97228 is a severity 8 vulnerability in Google's MCP toolbox caused by missing CheckRedirect policies and IP validation. The fix involves implementing an allow-list of IP ranges and block lists to reject unsafe base URLs at startup.

How does the 'protocol pivoting' attack technique work in AI agent systems?

Protocol pivoting exploits trust gaps to forward malicious instructions from one agent to another using different communication protocols. This technique enables server-side request forgery (SSRF) by causing agents to make unauthorized network requests to internal endpoints.

Which organizations have been affected by the MCP protocol vulnerabilities?

The vulnerabilities were demonstrated across systems used by Google, JP Morgan Chase, Weviate, Rapid7, the French government’s interministerial digital directorate, and the US federal government. Rapid7’s specific MCP server vulnerability was assigned a severity rating of 2.7 and has been fixed by the vendor.