FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.
Summary
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| agentfront | frontmcp | before 1.0.4 | 1.0.4 | Patch available | CNA |
| @frontmcp | adapters | before 1.0.4 | 1.0.4 | Patch available | CNA |
| @frontmcp | sdk | before 1.0.4 | 1.0.4 | Patch available | CNA |
| @frontmcp | mcp-from-openapi | before 2.3.0 | 2.3.0 | Patch available | CNA |
| — | mcp-from-openapi (npm) | before 2.3.0 | 2.3.0 | Patch available | GHSA-v6ph-xcq9-qxxj |
| — | @frontmcp/sdk (npm) | before 1.0.4 | 1.0.4 | Patch available | GHSA-v6ph-xcq9-qxxj |
| — | @frontmcp/adapters (npm) | before 1.0.4 | 1.0.4 | Patch available | GHSA-v6ph-xcq9-qxxj |
- frontmcp Vendoragentfront Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
- adapters Vendor@frontmcp Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
- sdk Vendor@frontmcp Affected before 1.0.4 Fixed in 1.0.4 Patch available CNA
- mcp-from-openapi Vendor@frontmcp Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
- mcp-from-openapi (npm) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-v6ph-xcq9-qxxj
- @frontmcp/sdk (npm) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-v6ph-xcq9-qxxj
- @frontmcp/adapters (npm) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-v6ph-xcq9-qxxj
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agentfront:\@frontmcp\/adapters:*:*:*:*:*:node.js:*:* | before 1.0.4 | Vulnerable | agentfront |
| cpe:2.3:a:agentfront:\@frontmcp\/sdk:*:*:*:*:*:node.js:*:* | before 1.0.4 | Vulnerable | agentfront |
| cpe:2.3:a:agentfront:frontmcp:*:*:*:*:*:node.js:*:* | before 1.0.4 | Vulnerable | agentfront |
| cpe:2.3:a:frontmcp:mcp-from-openapi:*:*:*:*:*:node.js:*:* | before 2.3.0 | Vulnerable | @frontmcp |
- cpe:2.3:a:agentfront:\@frontmcp\/adapters:*:*:*:*:*:node.js:*:* Versions before 1.0.4 Vulnerable ·agentfront
- cpe:2.3:a:agentfront:\@frontmcp\/sdk:*:*:*:*:*:node.js:*:* Versions before 1.0.4 Vulnerable ·agentfront
- cpe:2.3:a:agentfront:frontmcp:*:*:*:*:*:node.js:*:* Versions before 1.0.4 Vulnerable ·agentfront
- cpe:2.3:a:frontmcp:mcp-from-openapi:*:*:*:*:*:node.js:*:* Versions before 2.3.0 Vulnerable ·@frontmcp
Remediation
- Fix · CNA frontmcp (agentfront) Fixed in 1.0.4
- Fix · CNA adapters (@frontmcp) Fixed in 1.0.4
- Fix · CNA sdk (@frontmcp) Fixed in 1.0.4
- Fix · CNA mcp-from-openapi (frontmcp) Fixed in 2.3.0
- Fix · GHSA-v6ph-xcq9-qxxj mcp-from-openapi (npm) Fixed in 2.3.0 Advisory →
- Fix · GHSA-v6ph-xcq9-qxxj @frontmcp/sdk (npm) Fixed in 1.0.4 Advisory →
- Fix · GHSA-v6ph-xcq9-qxxj @frontmcp/adapters (npm) Fixed in 1.0.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-39885
- 2026-10-03 Alias added: GHSA-v6ph-xcq9-qxxj
References
Sources
- CVE-2026-39885 · CVE Program
- CVE-2026-39885 · NVD
- FIRST EPSS
- GHSA-v6ph-xcq9-qxxj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences