GHSA-rp72-5v5q-2446: @cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

June 26, 2026

@cardano402/mcp-server versions <= 0.1.1 ship three security gaps that can lead to unauthorized fund movement when the package is used as designed (an MCP server exposing Cardano payment tools to an

References

github.com/MorganOnCode/cardano402/security/advisories/GHSA-rp72-5v5q-2446
github.com/advisories/GHSA-rp72-5v5q-2446

Code Behaviors & Features

Detect and mitigate GHSA-rp72-5v5q-2446 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →