How to use Claude to find and fix SSRF flaws
Claude Code helped research two SSRF flaws. The researcher verified URL-boundary failures and worked with maintainers on parsing fixes and private advisories.
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Audit these authorized URL-fetch paths for the actual destination boundary, including address normalization, private IPv6 forms and DNS resolution. Reproduce candidate failures locally, propose parsing-library fixes and variant tests and prepare private maintainer disclosure rather than treating a code warning as a confirmed issue.
Reach people exploring AI agents
See placements →What happened
Two verified SSRF findings became CVE-2026-42260 and CVE-2026-42261, with maintainer-integrated parsing corrections and variant tests described in the account.
Reported by Shmulik Cohen — SubstackHow the agent did it
- Cohen selected projects and used Claude Code to inspect URL-fetching validation.
- He reproduced address-normalization and DNS-boundary problems before private disclosure.
- The researcher and maintainers integrated library-based parsing fixes and variant tests.
Where a person stepped in
Cohen chose projects, filtered false leads, reproduced behavior and worked privately with maintainers on patches and advisory handling.
Shmulik Cohen used Claude Code while researching small AI-related open-source projects and found two SSRF vulnerabilities. The agent helped read code and filter leads, while Cohen chose targets and investigated whether apparently protected URL fetchers could actually reach unintended destinations.
The first project, open-webSearch MCP, exposed a fetch service with permissive default access. Its private-address filter mishandled IPv6 representations and did not resolve DNS before deciding whether a destination was allowed. A related issue in PromptHub required authentication but still let URL normalization evade the intended boundary.
Cohen worked on fixes with maintainers rather than stopping at a demonstration. The corrections used established address-parsing libraries and normalization instead of expanding handwritten regular expressions. Private advisory collaboration provided a place to share proofs, patches and tests for alternative representations without immediately publishing the issue.
The account reports two CVEs and integrated remediation. It does not make a general promise that the projects became secure in every respect. The useful contribution is the combination of agent-supported code reading, human verification of an address boundary and maintainer-reviewed fixes. The researcher also had to enable and navigate the private advisory workflow, which was part of delivering a correction rather than merely producing a finding.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Substack · Shmulik Cohen
Frequently asked questions
What made the filters fail?
IPv6 normalization and unresolved DNS did not match the intended private-address boundary.
What changed in the fixes?
Maintainers used address-parsing libraries and normalization instead of handwritten regex checks.
Was disclosure only a public post?
No. Cohen describes private advisory collaboration and integrated patches.
More details
About this account
Cohen selected projects and used Claude Code to inspect URL-fetching validation. He reproduced address-normalization and DNS-boundary problems before private disclosure.
Original account opened; Medium mirror treated as the same account. Findings became CVE-2026-42260 and CVE-2026-42261. No claim that URL filtering alone secures the whole service. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: Shmulik Cohen — Substack
Source published 27 Apr 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code · Node.js · Python · GitHub security advisories
SSRF · Maintainer collaboration
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.