{"id":"CVE-2026-59973","summary":"mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi","details":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","aliases":["GHSA-65h7-9wrw-629c"],"modified":"2026-09-17T03:47:28.485334200Z","published":"2026-09-15T15:13:40.053Z","database_specific":{"cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59973.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/agentfront/frontmcp/releases/tag/v1.5.0"},{"type":"WEB","url":"https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59973.json"},{"type":"ADVISORY","url":"https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59973"},{"type":"FIX","url":"https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d"},{"type":"FIX","url":"https://github.com/agentfront/frontmcp/pull/496"},{"type":"FIX","url":"https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277"},{"type":"FIX","url":"https://github.com/agentfront/mcp-from-openapi/pull/7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/agentfront/frontmcp","events":[{"introduced":"0"},{"fixed":"96a78eaa5c6c4bc51cced557d83d1a03344cb03d"},{"fixed":"c1740dc4fd6a10e42f771b2c7715d2e091ec5d0e"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.5.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/agentfront/mcp-from-openapi","events":[{"introduced":"0"},{"fixed":"be3409cce6e97642696d4ee5a4e4e2712490b277"},{"fixed":"a8c0ff2f6fa1c072604d9c30027d8368f11a07b4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.5.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.5.0-rc.1","v0.8.1","v0.8.0","v0.7.2","v0.7.1","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.0","v0.3.1","v0.3.0","v0.2.5","v2.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59973.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"}]}