FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary The OpenAPI adapter's spec-change poller (OpenApiSpecPoller) re-fetched the configured spec url on a timer using a raw global fetch(), bypassing the SSRF guard (safeFetch / assertUrlSafe) that OpenAPIToolGenerator.fromURL() applies to the initial spec load. As a result, the pinning/DNS-resolution hardening delivered via mcp-from-openapi = 2.5.0 (advisory GHSA-65h7-9wrw-629c) protected the initial load but not the recurring poll of the same URL. When polling is enabled against an untrusted or attacker-influenceable spec URL, this is an unguarded SSRF vector. Details The initial spec load is guarded. OpenapiAdapter resolves a secure refResolution policy and passes it to the guarded loader: But the poller — which re-fetches the same URL on every interval — did not: Because doFetch() never called safeFetch, none of the guard's protections applied to the polled request: - no allow-list / block-list enforcement (allowedHosts / blockedHosts); - no…

Published by the source

24 Jul 2026, 22:40 UTC

Last modified by the source

24 Jul 2026, 22:45 UTC

Source last checked

26 Oct 2026, 12:58 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-8q49-2h5h-434x

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-8q49-2h5h-434x

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-8q49-2h5h-434x

Advisory: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
IDs: GHSA-8q49-2h5h-434x
Record: https://patchnext.com/advisories/ghsa-8q49-2h5h-434x (revision 2, source checked 26 Oct 2026, 12:58 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: @frontmcp/adapters 1.5.6. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm @frontmcp/adapters: affected <= 1.5.5; fixed in 1.5.6

## Suggested inspection (read-only)
- `npm ls @frontmcp/adapters --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on @frontmcp/adapters.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-8q49-2h5h-434x (OSV record GHSA-8q49-2h5h-434x lists affected ranges: npm @frontmcp/adapters >=0 <1.5.6 (fixed))
- Verified: https://github.com/advisories/GHSA-8q49-2h5h-434x (GitHub-reviewed advisory GHSA-8q49-2h5h-434x lists affected ranges: npm @frontmcp/adapters >=0 <=1.5.5)

Commands are suggestions: review each one before running it.