CVE-2026-81093
Received Received - Intake

SSRF via Unvalidated URL in get-html-skeleton Tool

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-09-17
AI Q&A
2026-08-27
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81093
EUVD
EUVD-2026-67148

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apify apify_mcp_server 0.9.12
apify apify_mcp_server to 0.9.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Apify MCP Server versions before 0.9.12. The get-html-skeleton tool only checked if a user-supplied URL started with http or https and was syntactically valid, without verifying the hostname or resolved address. This allowed attackers to provide URLs pointing to internal resources like cloud provider metadata services, which could expose instance credentials.

Detection Guidance

Check if your Apify MCP Server version is below 0.9.12. Inspect network logs for outbound requests to internal or metadata service IPs (e.g., 169.254.169.254 for AWS). Monitor for unusual tool usage like get-html-skeleton in logs.

Impact Analysis

An attacker could exploit this to make the server fetch internal endpoints, including cloud metadata services, and read sensitive data like instance credentials. This could lead to unauthorized access to cloud resources, data breaches, or further attacks within the internal network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's security requirements for protecting health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade to Apify MCP Server version 0.9.12 or later, which removes the vulnerable get-html-skeleton tool. Disable or restrict access to the tool if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart