Skip to content
Fencer Vulns
high 8.5

CVE-2026-59973 json

mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

published 2026-09-11 58 d ago modified 2026-09-30 39 d ago also GHSA-65h7-9wrw-629c , EUVD-2026-78782

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

Patch / fix

  • npm mcp-from-openapi 2.5.0
  • npm @frontmcp/adapters 1.5.0
  • npm frontmcp 1.5.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
53 d ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
GitHub 3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm mcp-from-openapi
>=2.3.0, <2.5.0
2.5.0
npm @frontmcp/adapters
>=1.2.1, <1.5.0
1.5.0
npm frontmcp
>=1.2.1, <1.5.0
1.5.0

Affected products

  • agentfront frontmcp
  • agentfront mcp-from-openapi
  • @frontmcp adapters

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.