CVE-2026-39885: FrontMCP SSRF and local file read in mcp-from-openapi

CVE-2026-39885 · Severity: high · CVSS 7.5 · Published 2026-04-08

FrontMCP is a framework used to integrate AI models with external tools and APIs. A security flaw in its OpenAPI processing component allows an attacker to provide a specially crafted API specification that forces the server to access internal network resources or read sensitive local files. This could lead to the theft of cloud service credentials (like AWS metadata) or the exposure of private system files, potentially compromising the entire hosting environment.

Technologies: @frontmcp/adapters (npm). Vendors: npm.

Quick answers

Is CVE-2026-39885 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39885 being exploited in the wild.
How severe is CVE-2026-39885?
High severity, with a CVSS score of 7.5, published 8 April 2026.
Which products and versions are affected?
Frontmcp Mcp-From-Openapi < 2.3.0; @frontmcp/adapters (npm) SEMVER:introduced=0,fixed=1.0.4; @frontmcp/sdk (npm) SEMVER:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-39885?
Yes. @frontmcp/adapters (npm): upgrade to 1.0.4 or later; @frontmcp/sdk (npm): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39885 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-39885?
Check whether you run Frontmcp Mcp-From-Openapi, @frontmcp/adapters (npm) or @frontmcp/sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @frontmcp/adapters (npm): upgrade to 1.0.4 or later
    npm install @frontmcp/adapters@1.0.4
  • @frontmcp/sdk (npm): upgrade to 1.0.4 or later
    npm install @frontmcp/sdk@1.0.4

Technical details

The mcp-from-openapi library (used by FrontMCP) utilizes @apidevtools/json-schema-ref-parser to handle $ref pointers within OpenAPI specifications. Prior to version 2.3.0, the library called the dereference() method without configuring URL restrictions, protocol blocks, or custom resolvers. An attacker can provide a malicious OpenAPI document containing $ref values pointing to internal IP addresses (e.g., cloud metadata endpoints at 169.254.169.254) or local files via the file:// protocol. When the initialize() function is called, the parser fetches these resources, allowing for unauthorized data retrieval and internal network probing. The issue is fixed in mcp-from-openapi v2.3.0 and FrontMCP v1.0.4.

Affected products

  • frontmcp mcp-from-openapi < 2.3.0
  • agentfront @frontmcp/adapters < 1.0.4
  • agentfront @frontmcp/sdk < 1.0.4
  • agentfront frontmcp < 1.0.4

Identifiers

  • CVE-2026-39885
  • GHSA-v6ph-xcq9-qxxj

Timeline

  • 2026-04-08: disclosed: Vulnerability reported by TharVid
  • 2026-04-08: patched: Fixed in FrontMCP v1.0.4 and mcp-from-openapi v2.3.0
  • 2026-04-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.