mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.9.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
The mcp-from-openapi library, which turns OpenAPI specifications into MCP tools, is affected by a flaw in its server-side request protections. An attacker who can supply an OpenAPI spec URL or a redirect target can add a trailing dot to a hostname the operator has blocked, which lets the request get past the denylist and reach internal or otherwise restricted hosts.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- agentfront mcp-from-openapi
From 2.2.0 · fixed in 2.9.0