{"id":"EUVD-2026-78782","enisaUuid":"8237ee1e-b306-3666-9d9e-a69bc10bfa9e","description":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","datePublished":"Sep 15, 2026, 3:13:40 PM","dateUpdated":"Sep 16, 2026, 4:06:53 PM","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c\nhttps://github.com/agentfront/frontmcp/pull/496\nhttps://github.com/agentfront/mcp-from-openapi/pull/7\nhttps://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d\nhttps://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277\nhttps://github.com/agentfront/frontmcp/releases/tag/v1.5.0\nhttps://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0\n","aliases":"CVE-2026-59973\nGHSA-65h7-9wrw-629c\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"18b8ec8d-5a94-3e43-a358-64aeda8828bf","product":{"name":"mcp-from-openapi","vendor":{"name":"frontmcp"}},"product_version":"\u003c 2.5.0"},{"id":"5947dbd6-c9d1-339d-bffd-7600c612f02f","product":{"name":"adapters","vendor":{"name":"@frontmcp"}},"product_version":"\u003c 1.5.0"},{"id":"d4bcf982-e462-3fa3-9c5d-3823db5e5ee2","product":{"name":"frontmcp","vendor":{"name":"agentfront"}},"product_version":"\u003c 1.5.0"}],"enisaIdVendor":[{"id":"ba474c0c-b8f5-34fa-af55-9f75934b5b57","vendor":{"name":"agentfront"}},{"id":"d9a42c74-f77c-35ec-a1a9-4d01a82c0977","vendor":{"name":"@frontmcp"}}],"enisaIdVulnerability":[{"id":"1a76431c-1b07-3426-a137-00d0a4710704","vulnerability":{"id":"CVE-2026-59973","description":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","datePublished":"Sep 15, 2026, 3:13:40 PM","dateUpdated":"Sep 16, 2026, 4:06:53 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","references":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c\nhttps://github.com/agentfront/frontmcp/pull/496\nhttps://github.com/agentfront/mcp-from-openapi/pull/7\nhttps://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d\nhttps://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277\nhttps://github.com/agentfront/frontmcp/releases/tag/v1.5.0\nhttps://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-78782\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 9, 2026, 3:07:23 PM","vulnerabilityProduct":[{"id":"2a8a113a-361c-3793-9c6e-f5e490ff83fe","product":{"name":"frontmcp","vendor":{"name":"agentfront"}},"product_version":"\u003c 1.5.0"},{"id":"b32d4358-8842-3c87-889b-015d1c2fb69b","product":{"name":"adapters","vendor":{"name":"@frontmcp"}},"product_version":"\u003c 1.5.0"},{"id":"d64f171c-196e-39b2-bdf4-ce2f552bb866","product":{"name":"mcp-from-openapi","vendor":{"name":"frontmcp"}},"product_version":"\u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"263346df-d55c-38c3-8ec9-06a386fd6153","vendor":{"name":"@frontmcp"}},{"id":"640da302-311f-3af6-bf99-c153ababdd3d","vendor":{"name":"agentfront"}}]}},{"id":"893cbd7b-dd1f-3c91-a55b-224d65639975","vulnerability":{"id":"GHSA-65h7-9wrw-629c","description":"FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix","datePublished":"Sep 11, 2026, 10:02:04 PM","dateUpdated":"Sep 11, 2026, 10:02:04 PM","baseScore":0.0,"references":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c\nhttps://github.com/agentfront/frontmcp\n","enisa_id":"EUVD-2026-78782\n","aliases":"GHSA-65h7-9wrw-629c\nCVE-2026-59973\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:05 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}