CVE-2026-59973: FrontMCP and mcp-from-openapi SSRF bypass in OpenAPI $ref resolution

CVE-2026-59973 · Severity: high · CVSS 8.5 · Published 2026-09-15

FrontMCP is a tool that converts OpenAPI specifications into AI agent adapters. A security patch intended to prevent attackers from triggering server-side requests to internal services was incomplete. Attackers can circumvent the fix by using alternative hostname forms (such as DNS names resolving to localhost) or IPv6 notation, allowing unauthorized access to internal APIs and network services that external users normally cannot reach.

Technologies: @frontmcp/adapters (npm). Vendors: npm.

Quick answers

Is CVE-2026-59973 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59973 being exploited in the wild.
How severe is CVE-2026-59973?
High severity, with a CVSS score of 8.5, published 15 September 2026.
Which products and versions are affected?
Agentfront \@Frontmcp\ >=1.2.1, <1.5.0; @frontmcp/adapters (npm) >= 1.2.1, < 1.5.0, SEMVER:introduced=1.2.1,fixed=1.5.0.
Is there a fix for CVE-2026-59973?
Yes. @frontmcp/adapters (npm): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59973 attacked?
It is attacked over the network.
Am I affected by CVE-2026-59973?
Check whether you run Agentfront \@Frontmcp\ or @frontmcp/adapters (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @frontmcp/adapters (npm): upgrade to 1.5.0 or later
    npm install @frontmcp/adapters@1.5.0

Technical details

The vulnerability exists in the OpenAPI external `$ref` dereferencing logic. The patched guard in mcp-from-openapi 2.3.0 checks the parsed URL hostname string against a blocklist of direct local and private addresses; however, it does not resolve hostnames to IP addresses before validation, does not pin the validated IP to the actual network request, and does not revalidate HTTP redirect targets. Additionally, IPv4-mapped IPv6 forms (e.g., `[::ffff:127.0.0.1]`) are not normalized before checking. This allows bypasses via: (1) DNS names resolving to 127.0.0.1 such as `127.0.0.1.nip.io`, (2) redirects from an allowed hostname to a loopback address, and (3) IPv4-mapped IPv6 loopback syntax. The attack requires the ability to provide an untrusted OpenAPI spec to the server, which is feasible in multi-user or hosted deployments. The patched version 1.5.0 and 2.5.0 of the affected packages address these bypasses.

Affected products

  • agentfront frontmcp >=1.2.1, <1.5.0
  • agentfront @frontmcp/adapters >=1.2.1, <1.5.0
  • node-mcp mcp-from-openapi >=2.3.0, <2.5.0

Identifiers

  • CVE-2026-59973
  • GHSA-65h7-9wrw-629c

Timeline

  • 2026-06-22: disclosed: Initially disclosed in GitHub Advisory Database
  • 2026-09-11: advisory: Advisory published as GHSA-65h7-9wrw-629c / CVE-2026-59973
  • 2026-09-11: patched: Patched versions released: frontmcp 1.5.0, @frontmcp/adapters 1.5.0, mcp-from-openapi 2.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.