TI-2026-28764 CVE-2026-39885 · GHSA-v6ph-xcq9-qxxj
FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Priority HIGH 72
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP).
agentfront
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
agentfront records in CISA KEVNo agentfront vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
1 record in Frontmcp · all components