Markitdown converts documents for an LLM. Feed it a URI and it fetches. BlueRock fed it the address every AWS engineer knows by heart and watched the server retrieve its own instance credentials.
The chain is short. Markitdown accepts a URI with no allowlist and no bound. Point it at 169.254.169.254, the EC2 metadata endpoint, and the server obediently makes the request from inside the VPC. On IMDSv1 that request is a plain GET, so the metadata service answers with the IAM role's temporary credentials. From there the attacker is authenticated to AWS as the box (BlueRock).
| Step | Request | Result |
|---|---|---|
| 1 | convert(uri) to a Markitdown MCP tool | Server fetches arbitrary URL |
| 2 | uri = http://169.254.169.254/latest/meta-data/iam/security-credentials/ | IMDSv1 returns role name |
| 3 | Same path + role name | Live access key, secret, session token |
| 4 | Creds against AWS API | Actions the instance role permits |
BlueRock then widened the scan. Of more than 7,000 MCP servers in its Trust Registry, 36.7% showed potential server-side request forgery exposure: a tool that can fetch attacker-controlled URLs from a host that trusts its own network position. That figure measures the precondition. AWS credential theft also requires an EC2 deployment with reachable IMDSv1 and an instance role worth stealing. CloudSEK's AIVigil work documents the same failure pattern elsewhere in the agent-tooling supply chain (CloudSEK).
The fix costs one command. Set the instance metadata options to require IMDSv2:
aws ec2 modify-instance-metadata-options \
--instance-id <id> --http-tokens required --http-endpoint enabledIMDSv2 forces a PUT-issued session token before it returns anything. A blind SSRF that can only issue GETs gets nothing. That closes the credential-theft leg even while the URI field stays wide open, which buys time to add an allowlist properly.
If you run an MCP server on EC2 that fetches URLs, check http-tokens today. Watch for the first MCP registry to reject servers without an SSRF allowlist as a listing requirement.
The Signal is the public edge of a private practice. Sherpa points the same intelligence engine at one owner's business — competitors, suppliers, regulators, watched daily, graded and sourced. Work with a Sherpa →