CVE-2026-39885
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
Impact
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mcp-from-openapi | <= 2.1.2 | 2.3.0 |
| npm | @frontmcp/sdk | <= 1.0.3 | 1.0.4 |
| npm | @frontmcp/adapters | <= 1.0.3 | 1.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Agentfront | \@Frontmcp\/Adapters | before 1.0.4 |
| Agentfront | \@Frontmcp\/Sdk | before 1.0.4 |
| Agentfront | Frontmcp | before 1.0.4 |
| Frontmcp | Mcp-From-Openapi | before 2.3.0 |