Actor MCP path authority injection leaks Apify token

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50143 · Microsoft / collected KEV context

EUVD-2026-61136

GHSA-6gr2-qh89-hxwm

cve-program · CVE-2026-50143

• https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm
• https://github.com/apify/apify-mcp-server/pull/927
• https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c
• https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11

euvd · EUVD-2026-61136

• https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm
• https://github.com/apify/apify-mcp-server/pull/927
• https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c
• https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11

nvd · CVE-2026-50143

• https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c
• https://github.com/apify/apify-mcp-server/pull/927
• https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11
• https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm

osv · GHSA-6gr2-qh89-hxwm

• https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm
• https://github.com/apify/apify-mcp-server

No related operational record is retained in the current change model.