Read the docs

agentfront

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

agentfront records in CISA KEV

No agentfront vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Enclave 3 records HIGH @frontmcp/adapters 1 record HIGH @frontmcp/sdk 1 record HIGH Frontmcp 1 record HIGH

Records

8 records

TI-2026-21983 CVE-2026-27597 · GHSA-f229-3862-4942

@enclave-vm/core is vulnerable to Sandbox Escape

Priority HIGH 82

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01007 Published 2026-02-25 Fixed in 2.11.1 CWE-94
TI-2026-79752 CVE-2026-115751 · GHSA-wfcf-h98w-gp9m

Incomplete denylist in Agentfront mcp-from-openapi allows SSRF via trailing dot

Priority MEDIUM 61

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0025 Published 2026-10-23 Fixed in 2.9.0 CWE-184
TI-2026-79751 CVE-2026-115750 · GHSA-3gr3-m4x5-3fpp

Credential leak via cross-origin redirects in mcp-from-openapi

Priority MEDIUM 61

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00221 Published 2026-10-23 Fixed in 2.9.0 CWE-522
Open these records in search →