{"metadata": {"vulnerability": "CVE-2026-59973", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-07-07T19:41:00.004Z", "date_only": false, "value": "2026-07-07T19:41:00.004Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59973", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-11T22:02:04Z", "date_only": false, "value": "2026-09-11T22:02:04Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-65H7-9WRW-629C", "record": "GHSA-65H7-9WRW-629C", "field": "published"}, {"timestamp": "2026-09-11T22:02:04Z", "date_only": false, "value": "2026-09-11T22:02:04Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-65H7-9WRW-629C", "record": "GHSA-65H7-9WRW-629C", "field": "modified"}, {"timestamp": "2026-09-15T15:13:40.053Z", "date_only": false, "value": "2026-09-15T15:13:40.053Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59973", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-15T15:13:40.053Z", "date_only": false, "value": "2026-09-15T15:13:40.053Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-59973", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-15T16:17:18.327Z", "date_only": false, "value": "2026-09-15T16:17:18.327", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59973", "record": "FKIE_CVE-2026-59973", "field": "published"}, {"timestamp": "2026-09-15T16:31:12.041Z", "date_only": false, "value": "2026-09-15T16:31:12.041885Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/8bd3e264f91a00f434cd5f27c8d28e71", "record": "CVE-2026-59973", "field": "creation_timestamp", "uuid": "1dbe0ed2-daf5-4e1a-857b-053e5bbcce49", "content": "# CVE-2026-59973: CVE-2026-59973: High-Severity Server-Side Request Forgery in FrontMCP and mcp-from-openapi\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-09-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59973\n\n## Summary\nCVE-2026-59973 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in FrontMCP and its underlying OpenAPI parsing library, mcp-from-openapi. The flaw allows authenticated attackers capable of importing or configuring OpenAPI specifications to bypass string-based hostname filtering mechanisms. By employing DNS wildcard loopbacks, HTTP redirects, or IPv4-mapped IPv6 address formatting, attackers can coerce the application into sending HTTP requests to internal networks, loopback adapters, and cloud metadata environments.\n\n## TL;DR\nA validation bypass in FrontMCP and mcp-from-openapi allows authenticated users to execute arbitrary Server-Side Request Forgery (SSRF) attacks against internal interfaces, bypassing existing string-based denylists through DNS wildcards, HTTP redirects, or IPv4-mapped IPv6 addresses.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.5\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact Type**: Server-Side Request Forgery\n\n## Affected Systems\n\n- FrontMCP hosted tool generation services\n- Internal networks connected to FrontMCP containers\n- Cloud hosting platform metadata environments (IMDSv1/v2)\n- **frontmcp**: >= 1.2.1 < 1.5.0 (Fixed in: `1.5.0`)\n- **@frontmcp/adapters**: >= 1.2.1 < 1.5.0 (Fixed in: `1.5.0`)\n- **mcp-from-openapi**: >= 2.3.0 < 2.5.0 (Fixed in: `2.5.0`)\n\n## Mitigation\n\n- Upgrade FrontMCP to version >= 1.5.0\n- Upgrade mcp-from-openapi to version >= 2.5.0\n- Disable external schema resolution via empty allowedProtocols rules\n- Implement network egress restrictions on container environments hosting FrontMCP\n\n**Remediation Steps:**\n1. Review npm dependency tree for vulnerable versions of mcp-from-openapi (< 2.5.0) and frontmcp (< 1.5.0).\n2. Execute `npm install frontmcp@1.5.0` or update package.json to point to fixed versions.\n3. Locate initialization files containing `OpenapiAdapter.init` and ensure `refResolution.allowedProtocols` is empty or locked to verified hosts.\n4. Deploy egress firewalls or network security groups to restrict outward container traffic to internal RFC 1918 networks.\n\n## References\n\n- [FrontMCP Security Advisory](https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c)\n- [FrontMCP Release Version 1.5.0](https://github.com/agentfront/frontmcp/releases/tag/v1.5.0)\n- [mcp-from-openapi Release Version 2.5.0](https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59973) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/8bd3e264f91a00f434cd5f27c8d28e71"}, {"timestamp": "2026-09-16T16:06:47.172Z", "date_only": false, "value": "2026-09-16T16:06:47.172118Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59973", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-16T16:06:47.172Z", "date_only": false, "value": "2026-09-16T16:06:47.172118Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59973", "record": "FKIE_CVE-2026-59973", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-16T16:06:53.148Z", "date_only": false, "value": "2026-09-16T16:06:53.148Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59973", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-16T16:06:53.148Z", "date_only": false, "value": "2026-09-16T16:06:53.148Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59973", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-30T17:51:56.193Z", "date_only": false, "value": "2026-09-30T17:51:56.193", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59973", "record": "FKIE_CVE-2026-59973", "field": "lastModified"}]}