Executive brief
FrontMCP is a framework used to integrate AI models with external tools and APIs. A security flaw in its OpenAPI processing component allows an attacker to provide a specially crafted API specification that forces the server to access internal network resources or read sensitive local files. This could lead to the theft of cloud service credentials (like AWS metadata) or the exposure of private system files, potentially compromising the entire hosting environment.
Technical details
The mcp-from-openapi library (used by FrontMCP) utilizes @apidevtools/json-schema-ref-parser to handle $ref pointers within OpenAPI specifications. Prior to version 2.3.0, the library called the dereference() method without configuring URL restrictions, protocol blocks, or custom resolvers. An attacker can provide a malicious OpenAPI document containing $ref values pointing to internal IP addresses (e.g., cloud metadata endpoints at 169.254.169.254) or local files via the file:// protocol. When the initialize() function is called, the parser fetches these resources, allowing for unauthorized data retrieval and internal network probing. The issue is fixed in mcp-from-openapi v2.3.0 and FrontMCP v1.0.4.
Affected products
- frontmcp mcp-from-openapi < 2.3.0
- agentfront @frontmcp/adapters < 1.0.4
- agentfront @frontmcp/sdk < 1.0.4
- agentfront frontmcp < 1.0.4
Timeline
- 2026-04-08: disclosed: Vulnerability reported by TharVid
- 2026-04-08: patched: Fixed in FrontMCP v1.0.4 and mcp-from-openapi v2.3.0
- 2026-04-08: advisory