mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| agentfront | frontmcp | before 1.5.0 | 1.5.0 | Patch available | CNA |
| agentfront | mcp-from-openapi | before 2.5.0 | 2.5.0 | Patch available | CNA |
| @frontmcp | adapters | before 1.5.0 | 1.5.0 | Patch available | CNA |
| — | mcp-from-openapi (npm) | 2.3.0 to before 2.5.0 | 2.5.0 | Patch available | GHSA-65h7-9wrw-629c |
| — | @frontmcp/adapters (npm) | 1.2.1 to before 1.5.0 | 1.5.0 | Patch available | GHSA-65h7-9wrw-629c |
| — | frontmcp (npm) | 1.2.1 to before 1.5.0 | 1.5.0 | Patch available | GHSA-65h7-9wrw-629c |
- frontmcp Vendoragentfront Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
- mcp-from-openapi Vendoragentfront Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA
- adapters Vendor@frontmcp Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA
- mcp-from-openapi (npm) Vendor— Affected 2.3.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-65h7-9wrw-629c
- @frontmcp/adapters (npm) Vendor— Affected 1.2.1 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-65h7-9wrw-629c
- frontmcp (npm) Vendor— Affected 1.2.1 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-65h7-9wrw-629c
Remediation
- Fix · CNA frontmcp (agentfront) Fixed in 1.5.0
- Fix · CNA mcp-from-openapi (agentfront) Fixed in 2.5.0
- Fix · CNA adapters (@frontmcp) Fixed in 1.5.0
- Fix · GHSA-65h7-9wrw-629c mcp-from-openapi (npm) Fixed in 2.5.0 Advisory →
- Fix · GHSA-65h7-9wrw-629c @frontmcp/adapters (npm) Fixed in 1.5.0 Advisory →
- Fix · GHSA-65h7-9wrw-629c frontmcp (npm) Fixed in 1.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59973
- 2026-10-03 Alias added: GHSA-65h7-9wrw-629c
References
Other 8
- https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c
- https://github.com/agentfront/frontmcp/pull/496
- https://github.com/agentfront/mcp-from-openapi/pull/7
- https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d
- https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277
- https://github.com/agentfront/frontmcp/releases/tag/v1.5.0
- https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0
- https://github.com/agentfront/frontmcp
More agentfront vulnerabilities
- TI-2026-21983 @enclave-vm/core is vulnerable to Sandbox Escape CVSS 3.1CRITICAL 10.0
- TI-2026-18213 Sandbox Escape via Host Error Prototype Chain in enclave-vm CVSS 3.1CRITICAL 10.0
- TI-2026-47732 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool CVSS 4.0CRITICAL 9.3
- TI-2026-28764 FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications CVSS 3.1HIGH 7.5
- TI-2026-79752 Incomplete denylist in Agentfront mcp-from-openapi allows SSRF via trailing dot CVSS 4.0MEDIUM 6.3
- TI-2026-79751 Credential leak via cross-origin redirects in mcp-from-openapi CVSS 4.0MEDIUM 6.3
Sources
- CVE-2026-59973 · CVE Program
- CVE-2026-59973 · NVD
- FIRST EPSS
- GHSA-65h7-9wrw-629c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences