CVE-2026-39885 Details
Description
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in FrontMCP versions prior to 2.3.0. The issue arises in the 'mcp-from-openapi' library, which dereferences '$ref' pointers in OpenAPI specifications using '@apidevtools/json-schema-ref-parser'. This process, lacking proper URL restrictions or custom resolvers, can be exploited by a malicious OpenAPI specification that directs '$ref' values to internal network addresses, cloud metadata endpoints, or local files. During the 'initialize()' call', the library fetches these resources, leading to potential SSRF and local file read attacks when handling untrusted OpenAPI specifications.
Users can upgrade to FrontMCP version 2.3.0 or later, where this vulnerability has been addressed. For those using the 'mcp-from-openapi' library, version 2.3.0 includes the necessary fix. Additionally, when using the library, it's recommended to configure '$ref' resolution options that restrict which protocols and hosts are allowed, or to disable external resolution entirely and require all schemas to be inline.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj | CISA-ADP | ExploitVendor Advisory |
| https://github.com/agentfront/frontmcp/releases/tag/v1.0.4 | [email protected] | Product |
| https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| agentfront @frontmcp/adapters | < 1.0.4 |
CPE
Remediation
| |
| agentfront @frontmcp/sdk | < 1.0.4 |
CPE
Remediation
| |
| agentfront frontmcp | < 1.0.4 |
CPE
Remediation
| |
| frontmcp mcp-from-openapi | < 2.3.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | [email protected] |