Vulnerabilities

TI-2026-56055 CVE-2026-81093 · GHSA-gghj-77w7-6r3h

Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

MEDIUM 44

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-08-27 Fixed in 0.9.12 CWE-918

TI-2026-36913 CVE-2026-50143 · GHSA-6gr2-qh89-hxwm

Actor MCP path authority injection leaks Apify token

HIGH 70

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00488 Published 2026-08-18 Fixed in 0.10.11 CWE-918

TI-2026-34061 CVE-2026-46341 · GHSA-jwp7-wg77-3w9v

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

MEDIUM 60

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00234 Published 2026-07-16 Fixed in 0.9.21 CWE-183

TI-2026-34195 CVE-2026-46497 · GHSA-3r75-xc34-5f44

SSRF via sitemap-derived URLs in Crawlee for Python

LOW 12

Crawlee is a web scraping and browser automation library.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00286 Published 2026-06-10 Fixed in 1.7.0 CWE-918

Vulnerabilities

Filters

Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

Actor MCP path authority injection leaks Apify token

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

SSRF via sitemap-derived URLs in Crawlee for Python