Vulnerability-Lookup

CVE-2026-59973 (GCVE-0-2026-59973)

Vulnerability from cvelistv5 – Published: 2026-09-15 15:13 – Updated: 2026-09-16 16:06

Title

mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

Summary

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 16:06 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7635 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/agentfront/frontmcp/security/a…	x_refsource_CONFIRM
https://github.com/agentfront/frontmcp/pull/496	x_refsource_MISC
https://github.com/agentfront/mcp-from-openapi/pull/7	x_refsource_MISC
https://github.com/agentfront/frontmcp/commit/96a…	x_refsource_MISC
https://github.com/agentfront/mcp-from-openapi/co…	x_refsource_MISC
https://github.com/agentfront/frontmcp/releases/t…	x_refsource_MISC
https://github.com/agentfront/mcp-from-openapi/re…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version	CPE status
agentfront	frontmcp	Affected: < 1.5.0	guessed
agentfront	mcp-from-openapi	Affected: < 2.5.0	guessed
@frontmcp	adapters	Affected: < 1.5.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59973",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:06:47.172118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T16:06:53.148Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "frontmcp",
          "vendor": "agentfront",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        },
        {
          "product": "mcp-from-openapi",
          "vendor": "agentfront",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        },
        {
          "product": "adapters",
          "vendor": "@frontmcp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T15:13:40.053Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
        },
        {
          "name": "https://github.com/agentfront/frontmcp/pull/496",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/frontmcp/pull/496"
        },
        {
          "name": "https://github.com/agentfront/mcp-from-openapi/pull/7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/mcp-from-openapi/pull/7"
        },
        {
          "name": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d"
        },
        {
          "name": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277"
        },
        {
          "name": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0"
        },
        {
          "name": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-65h7-9wrw-629c",
        "discovery": "UNKNOWN"
      },
      "title": "mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59973",
    "datePublished": "2026-09-15T15:13:40.053Z",
    "dateReserved": "2026-07-07T19:41:00.004Z",
    "dateUpdated": "2026-09-16T16:06:53.148Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59973",
      "date": "2026-10-22",
      "epss": "0.00393",
      "percentile": "0.3227"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "frontmcp",
                "vendor": "agentfront",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.5.0"
                  }
                ]
              },
              {
                "product": "mcp-from-openapi",
                "vendor": "agentfront",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.5.0"
                  }
                ]
              },
              {
                "product": "adapters",
                "vendor": "@frontmcp",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.5.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0."
          }
        ],
        "id": "CVE-2026-59973",
        "lastModified": "2026-09-30T17:51:56.193",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59973",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T16:06:47.172118Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T16:17:18.327",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/frontmcp/pull/496"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/mcp-from-openapi/pull/7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59973",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T16:06:47.172118Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T16:06:33.577Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "frontmcp",
              "vendor": "agentfront",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.5.0"
                }
              ]
            },
            {
              "product": "mcp-from-openapi",
              "vendor": "agentfront",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.5.0"
                }
              ]
            },
            {
              "product": "adapters",
              "vendor": "@frontmcp",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.5.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T15:13:40.053Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
            },
            {
              "name": "https://github.com/agentfront/frontmcp/pull/496",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/frontmcp/pull/496"
            },
            {
              "name": "https://github.com/agentfront/mcp-from-openapi/pull/7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/mcp-from-openapi/pull/7"
            },
            {
              "name": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d"
            },
            {
              "name": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277"
            },
            {
              "name": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0"
            },
            {
              "name": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"
            }
          ],
          "source": {
            "advisory": "GHSA-65h7-9wrw-629c",
            "discovery": "UNKNOWN"
          },
          "title": "mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59973",
        "datePublished": "2026-09-15T15:13:40.053Z",
        "dateReserved": "2026-07-07T19:41:00.004Z",
        "dateUpdated": "2026-09-15T15:13:40.053Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59973

Vulnerability from fkie_nvd - Published: 2026-09-15 16:17 - Updated: 2026-09-30 17:51

Severity

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d
	security-advisories@github.com	https://github.com/agentfront/frontmcp/pull/496
	security-advisories@github.com	https://github.com/agentfront/frontmcp/releases/tag/v1.5.0
	security-advisories@github.com	https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c
	security-advisories@github.com	https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277
	security-advisories@github.com	https://github.com/agentfront/mcp-from-openapi/pull/7
	security-advisories@github.com	https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "frontmcp",
          "vendor": "agentfront",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        },
        {
          "product": "mcp-from-openapi",
          "vendor": "agentfront",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        },
        {
          "product": "adapters",
          "vendor": "@frontmcp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0."
    }
  ],
  "id": "CVE-2026-59973",
  "lastModified": "2026-09-30T17:51:56.193",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59973",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T16:06:47.172118Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T16:17:18.327",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/frontmcp/pull/496"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/frontmcp/releases/tag/v1.5.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/mcp-from-openapi/pull/7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-65H7-9WRW-629C

Vulnerability from github – Published: 2026-09-11 22:02 – Updated: 2026-09-11 22:02

Summary

FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

Details

Summary

The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.

FrontMCP latest release v1.2.1 and current main still call OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON() from mcp-from-openapi 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.

This is a latest-version bypass of the previous fix. A direct http://127.0.0.1 $ref control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.

Latest versions checked

frontmcp npm latest: 1.2.1
@frontmcp/adapters npm latest: 1.2.1
mcp-from-openapi npm latest: 2.3.0
FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944
FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756

The release tag and current main both keep mcp-from-openapi 2.3.0 in package.json and libs/adapters/package.json, and both keep the OpenAPI adapter forwarding untrusted url, spec, and loadOptions.refResolution into OpenAPIToolGenerator.

Technical details

FrontMCP's OpenAPI adapter reaches the affected dependency paths:

libs/adapters/src/openapi/openapi.adapter.ts imports OpenAPIToolGenerator from mcp-from-openapi.
loadOpenAPISpec() calls OpenAPIToolGenerator.fromURL(this.options.url, ...) and forwards loadOptions.refResolution.
The same method calls OpenAPIToolGenerator.fromJSON(this.options.spec, ...) and forwards loadOptions.refResolution.

In mcp-from-openapi 2.3.0, the patched guard is applied before the HTTP resolver fetches an external $ref. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.

As a result, these URLs are accepted by the guard but cause a loopback request from the backend:

http://127.0.0.1.nip.io:<port>/schema.json, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.
http://127.0.0.1.nip.io:<port>/redirect, because the first host passes and the actual request follows a redirect to http://127.0.0.1:<port>/schema.json.
http://[::ffff:127.0.0.1]:<port>/schema.json and http://[::ffff:7f00:1]:<port>/schema.json, because IPv4-mapped IPv6 loopback is not normalized and denied.

OpenAPIToolGenerator.fromURL() is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external $ref fix bypass.

Reproduction

The attached local PoC starts a loopback canary and loads generated OpenAPI specs using mcp-from-openapi 2.3.0. The request body schema contains a single external $ref for each test case. The canary records every backend-origin request.

Run:

cd /home/unkn0wn/security_audit/frontmcp-ssrf-poc
node repro-frontmcp-latest-ssrf-bypasses.mjs

Important output from a fresh run on 2026-05-25:

{"name":"direct-127-denied-control","kind":"external_ref","refUrl":"http://127.0.0.1:45117/schema.json","ok":false,"hitCount":0,"hits":[]}
{"name":"dns-name-to-127-bypass","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"dns-name-to-127-bypass-with-allowedHosts","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"redirect-to-127-after-allowed-host","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/redirect","ok":true,"hitCount":2,"hits":[{"url":"/redirect","host":"127.0.0.1.nip.io:45117","authorization":null},{"url":"/schema.json","host":"127.0.0.1:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-dotted-bypass","kind":"external_ref","refUrl":"http://[::ffff:127.0.0.1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-hex-bypass","kind":"external_ref","refUrl":"http://[::ffff:7f00:1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"external-refs-disabled-control","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":0,"hits":[]}

Controls:

Direct loopback $ref is denied and the canary records zero requests.
Numeric IPv4 variants tested as parser controls were denied with zero requests.
Default file:// resolution was denied in this runtime.
Setting refResolution.allowedProtocols: [] prevents the external request, but this is not the default.

Impact

The previous advisory documented SSRF during untrusted OpenAPI $ref dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.

The impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.

Remediation

Do not rely on parsed hostname denylist checks for external $ref URLs.
Resolve hostnames before the request and reject loopback, private, link-local, multicast, unspecified, and metadata ranges.
Normalize IPv4-mapped IPv6 before range checks.
Revalidate every redirect target before following it, or disable redirects during external $ref dereferencing.
Pin the validated IP to the actual request with a custom dispatcher, lookup hook, or equivalent connect-time control.
Apply the same protected client to fromURL() initial spec loads.
Consider disabling external refs by default for untrusted OpenAPI specs and requiring explicit allowlists.
Add regression tests for direct loopback, DNS-to-loopback, redirect-to-loopback, IPv4-mapped IPv6, numeric IP forms, file refs, and disabled external refs.

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mcp-from-openapi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@frontmcp/adapters"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.1"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "frontmcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2.1"
            },
            {
              "fixed": "1.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59973"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T22:02:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.\n\nFrontMCP latest release v1.2.1 and current main still call `OpenAPIToolGenerator.fromURL()` and `OpenAPIToolGenerator.fromJSON()` from `mcp-from-openapi` 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.\n\nThis is a latest-version bypass of the previous fix. A direct `http://127.0.0.1` `$ref` control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.\n\n## Latest versions checked\n\n- `frontmcp` npm latest: 1.2.1\n- `@frontmcp/adapters` npm latest: 1.2.1\n- `mcp-from-openapi` npm latest: 2.3.0\n- FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944\n- FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756\n\nThe release tag and current main both keep `mcp-from-openapi` 2.3.0 in `package.json` and `libs/adapters/package.json`, and both keep the OpenAPI adapter forwarding untrusted `url`, `spec`, and `loadOptions.refResolution` into `OpenAPIToolGenerator`.\n\n## Technical details\n\nFrontMCP\u0027s OpenAPI adapter reaches the affected dependency paths:\n\n- `libs/adapters/src/openapi/openapi.adapter.ts` imports `OpenAPIToolGenerator` from `mcp-from-openapi`.\n- `loadOpenAPISpec()` calls `OpenAPIToolGenerator.fromURL(this.options.url, ...)` and forwards `loadOptions.refResolution`.\n- The same method calls `OpenAPIToolGenerator.fromJSON(this.options.spec, ...)` and forwards `loadOptions.refResolution`.\n\nIn `mcp-from-openapi` 2.3.0, the patched guard is applied before the HTTP resolver fetches an external `$ref`. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.\n\nAs a result, these URLs are accepted by the guard but cause a loopback request from the backend:\n\n- `http://127.0.0.1.nip.io:\u003cport\u003e/schema.json`, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.\n- `http://127.0.0.1.nip.io:\u003cport\u003e/redirect`, because the first host passes and the actual request follows a redirect to `http://127.0.0.1:\u003cport\u003e/schema.json`.\n- `http://[::ffff:127.0.0.1]:\u003cport\u003e/schema.json` and `http://[::ffff:7f00:1]:\u003cport\u003e/schema.json`, because IPv4-mapped IPv6 loopback is not normalized and denied.\n\n`OpenAPIToolGenerator.fromURL()` is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external `$ref` fix bypass.\n\n## Reproduction\n\nThe attached local PoC starts a loopback canary and loads generated OpenAPI specs using `mcp-from-openapi` 2.3.0. The request body schema contains a single external `$ref` for each test case. The canary records every backend-origin request.\n\nRun:\n\n```bash\ncd /home/unkn0wn/security_audit/frontmcp-ssrf-poc\nnode repro-frontmcp-latest-ssrf-bypasses.mjs\n```\n\nImportant output from a fresh run on 2026-05-25:\n\n```json\n{\"name\":\"direct-127-denied-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1:45117/schema.json\",\"ok\":false,\"hitCount\":0,\"hits\":[]}\n{\"name\":\"dns-name-to-127-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"dns-name-to-127-bypass-with-allowedHosts\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"redirect-to-127-after-allowed-host\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/redirect\",\"ok\":true,\"hitCount\":2,\"hits\":[{\"url\":\"/redirect\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null},{\"url\":\"/schema.json\",\"host\":\"127.0.0.1:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-dotted-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:127.0.0.1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-hex-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:7f00:1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"external-refs-disabled-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":0,\"hits\":[]}\n```\n\nControls:\n\n1. Direct loopback `$ref` is denied and the canary records zero requests.\n2. Numeric IPv4 variants tested as parser controls were denied with zero requests.\n3. Default `file://` resolution was denied in this runtime.\n4. Setting `refResolution.allowedProtocols: []` prevents the external request, but this is not the default.\n\n## Impact\n\nThe previous advisory documented SSRF during untrusted OpenAPI `$ref` dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.\n\nThe impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.\n\n## Remediation\n\n1. Do not rely on parsed hostname denylist checks for external `$ref` URLs.\n2. Resolve hostnames before the request and reject loopback, private, link-local, multicast, unspecified, and metadata ranges.\n3. Normalize IPv4-mapped IPv6 before range checks.\n4. Revalidate every redirect target before following it, or disable redirects during external `$ref` dereferencing.\n5. Pin the validated IP to the actual request with a custom dispatcher, lookup hook, or equivalent connect-time control.\n6. Apply the same protected client to `fromURL()` initial spec loads.\n7. Consider disabling external refs by default for untrusted OpenAPI specs and requiring explicit allowlists.\n8. Add regression tests for direct loopback, DNS-to-loopback, redirect-to-loopback, IPv4-mapped IPv6, numeric IP forms, file refs, and disabled external refs.",
  "id": "GHSA-65h7-9wrw-629c",
  "modified": "2026-09-11T22:02:04Z",
  "published": "2026-09-11T22:02:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/agentfront/frontmcp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59973 (GCVE-0-2026-59973)

FKIE_CVE-2026-59973

GHSA-65H7-9WRW-629C

Summary

Latest versions checked

Technical details

Reproduction

Impact

Remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour