CVE-2026-39885: FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-08 · updated 2026-07-24
Weakness: CWE-918

Description

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.

Affected products

agentfront @Frontmcp/Adapters: before 1.0.4 — fixed in 1.0.4
agentfront @Frontmcp/Sdk: before 1.0.4 — fixed in 1.0.4
agentfront frontmcp: before 1.0.4 — fixed in 1.0.4
frontmcp mcp-from-openapi: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: agentfront @Frontmcp/Adapters 1.0.4; agentfront @Frontmcp/Sdk 1.0.4; agentfront frontmcp 1.0.4; frontmcp mcp-from-openapi 2.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39885 or the next vulnerability affects your stack