The EPSS score of 0.00409 for this SSRF in MissionSquad's mcp-api deserves scrutiny — a CVSS 6.3 with remote exploitability and no authentication requirement typically correlates with substantially higher exploitation probability. Don't treat the low EPSS as a reason to deprioritize this patch without understanding why the gap exists.
The vulnerability lives in src/services/dcrClients.ts, an HTTP client module making outbound requests to downstream services. This is client-side SSRF, which is genetically distinct from the endpoint-SSRF most scanners target. The critical distinction: when dcrClients.ts makes a request, it does so under the service identity of the mcp-api process — whatever IAM role, service account, or network position that process carries. That's the blast radius multiplier neither CVSS nor EPSS captures. An attacker who manipulates the outbound URL isn't just fetching internal URLs; they're inheriting access to whatever credentials the service identity holds.
The canonical attack path is credential inheritance → AWS metadata endpoint (169.254.169.254) or equivalent cloud IMDS → cross-account keys or instance credentials → lateral movement. If mcp-api runs on AWS with a moderately permissive IAM role, the actual exposure could substantially exceed what the CVSS 6.3 suggests. The EPSS may reflect narrow deployment footprint or that mass exploitation tooling hasn't targeted this specific codebase — not that the vulnerability lacks targeted value for adversaries with cloud access.
Examine the fix commit f068ab4ad6f0907ac7001b995588c2673f11a755 to determine what validation was missing. If the patch added an allowlist of permitted hosts, the original code had no destination constraints. If it added denylist logic for internal IP ranges, that's a known evolutionary dead end — denylists are routinely bypassed in SSRF. The pattern choice reveals what primitives were available to the developer and whether the codebase had accessible URL validation helpers.
Client-side SSRF also tends to survive longer in codebases because security tooling focuses on inbound request handlers. SAST and DAST scanners routinely miss unsanitized URL construction in outbound HTTP clients like dcrClients.ts — not because the vulnerability wasn't there, but because the tooling's attention lapsed on the outbound path. Verify whether your scanning pipeline explicitly traces outbound HTTP calls.
For defenders: prioritize this patch if you run mcp-api, regardless of the EPSS. The combination of SSRF, client-side execution context, and service identity inheritance makes this a high-signal target even at low mass-exploitation probability.