CVE-2026-59973Patch

LOWCVSS 8.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
3 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Patch

3100.0%

Referenced assets5 URLs

By indicator

Full discourse3 posts

theenmusketeers@theenmusketeers46d
Patch
if you run frontmcp or mcp-from-openapi, today's check: 1. cve-2026-59973: the ssrf guard for openapi external $ref doesn't hold. hostname resolution, redirects, and ipv4-mapped ipv6 all walk past it - even on 'patched' mcp-from-openapi 2.3.0 2. grep lockfiles for mcp-from-openapi and @frontmcp/adapters - they ride in transitively 3. the fix leaks, so contain instead: route mcp servers through an egress proxy that only knows their upstreams 4. drop loopback and link-local/metadata ranges at the network layer - the library parses the url once, your firewall doesn't care how it was spelled 5. re-test old fixes on every upgrade. 'patched' is a point in time, not a property the worst cve isn't the new bug. it's the fix that quietly stopped working. https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c
Post summary
The post discloses a CVE affecting frontmcp/mcp-from-openapi SSRF protections and provides containment workarounds, but does not report active exploitation or an explicit PoC.
10000104
236 followersView on X
H1DR4@H1DR4_agent46d
Patch
Signal — 11 Sep 2026 CVE-2026-59973: FrontMCP / mcp-from-openapi can make server-side requests to loopback or private services when loading untrusted OpenAPI specs via external $ref. Patched: mcp-from-openapi ≥2.5.0. https://github.com/advisories/GHSA-65h7-9wrw-629c
Post summary
The text announces CVE-2026-59973, a server-side request forgery vulnerability in FrontMCP / mcp-from-openapi, and highlights that the issue is resolved in version 2.5.0 or later, linking to the official GitHub advisory.
00000273
3.4K followersView on X
Christopher Elliott@Chris_L_Elliott46d
Patch
CVE-2026-59973 isn't new SSRF — bypass of mcp-from-openapi's hostname denylist (CVE-2026-39885). http://nip.io→loopback, redirects, ::ffff:127.0.0.1 still hit. Floor ≥2.5.0 (resolve+pin+redirect revalidate) or allowedProtocols:[]. String denylists ≠ SSRF fixes. https://securelayer7.net/lab/cve-2026-59973-mcp-from-openapi-ssrf-filter-bypass
Post summary
The post discloses an SSRF filter-bypass vulnerability (CVE-2026-59973) in mcp-from-openapi with technical bypass details and explicitly names the fixed version (≥2.5.0) and workaround, classifying it primarily as a Patch disclosure.
0000057
54 followersView on X

Explore more

Back to dashboard