CVE-2026-59973
Received Received - Intake

Server-Side Request Forgery in FrontMCP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-59973
EUVD
EUVD-2026-78782

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
agentfront mcp-from-openapi From 2.3.0 (inc) to 2.5.0 (inc)
agentfront mcp-from-openapi 2.5.0
agentfront frontmcp From 1.2.1 (inc) to 1.5.0 (inc)
agentfront frontmcp 1.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in FrontMCP and mcp-from-openapi libraries. It allows authenticated users who can import or configure OpenAPI specs to make backend servers send requests to internal services by exploiting DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms. This can expose internal administrative APIs, metadata services, or private network endpoints.

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected internal requests originating from FrontMCP or mcp-from-openapi processes. Check logs for SSRF attempts using tools like tcpdump or Wireshark to capture outbound connections to localhost, RFC 1918 private IPs, or other internal endpoints. Inspect OpenAPI spec loading for external $ref resolutions to suspicious domains or IPs.

Impact Analysis

An attacker could access internal services, leading to unauthorized data exposure or manipulation. The impact is higher in hosted or multi-user deployments where untrusted users can configure OpenAPI specs. The vulnerability allows bypassing previous SSRF fixes through techniques like DNS rebinding or using special IP formats.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches exposing personal or health information, leading to regulatory penalties and compliance failures.

Mitigation Strategies
  • Upgrade to fixed versions: mcp-from-openapi >=2.5.0 and frontmcp/@frontmcp/adapters >=1.5.0 to apply SSRF protections.
  • Disable external $ref resolution by default in OpenAPI adapter configurations (set allowedProtocols: [] and followRedirects: false).
  • Block internal IP ranges in network firewalls or application-level controls for FrontMCP processes.
  • Restrict OpenAPI spec uploads to trusted administrators only in multi-user deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart