CVE-2026-115750 Details
Description
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.
A credential exposure vulnerability has been identified in mcp-from-openapi versions 2.5.0 prior to 2.9.0. This vulnerability allows attackers to capture Authorization and Cookie headers because the function safeFetch() forwards these headers during cross-origin redirects. An attacker controlling a specification host or exploiting an open redirect can redirect requests to their own origin, stealing bearer tokens or cookies.
Users can upgrade to mcp-from-openapi version 2.9.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/agentfront/mcp-from-openapi/security/advisories/GHSA-ff5q-5r4v-fw4v | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/agentfront/mcp-from-openapi/commit/47fb7a655de33958b0c923490ab244343eb5fc44 | [email protected] | Source CodeVendor |
| https://github.com/agentfront/mcp-from-openapi/pull/42 | [email protected] | Issue TrackingVendor |
| https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.9.0 | [email protected] | Release NotesVendor |
| https://github.com/agentfront/mcp-from-openapi/security/advisories/GHSA-ff5q-5r4v-fw4v | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/mcp-from-openapi-from-2.5.0-before-2.9.0-credential-leak-via-cross-origin-redirects | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| agentfront mcp-from-openapi | <= 2.8.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |