Executive brief
FrontMCP is a tool that converts OpenAPI specifications into AI agent adapters. A security patch intended to prevent attackers from triggering server-side requests to internal services was incomplete. Attackers can circumvent the fix by using alternative hostname forms (such as DNS names resolving to localhost) or IPv6 notation, allowing unauthorized access to internal APIs and network services that external users normally cannot reach.
Technical details
The vulnerability exists in the OpenAPI external `$ref` dereferencing logic. The patched guard in mcp-from-openapi 2.3.0 checks the parsed URL hostname string against a blocklist of direct local and private addresses; however, it does not resolve hostnames to IP addresses before validation, does not pin the validated IP to the actual network request, and does not revalidate HTTP redirect targets. Additionally, IPv4-mapped IPv6 forms (e.g., `[::ffff:127.0.0.1]`) are not normalized before checking. This allows bypasses via: (1) DNS names resolving to 127.0.0.1 such as `127.0.0.1.nip.io`, (2) redirects from an allowed hostname to a loopback address, and (3) IPv4-mapped IPv6 loopback syntax. The attack requires the ability to provide an untrusted OpenAPI spec to the server, which is feasible in multi-user or hosted deployments. The patched version 1.5.0 and 2.5.0 of the affected packages address these bypasses.
Affected products
- agentfront frontmcp >=1.2.1, <1.5.0
- agentfront @frontmcp/adapters >=1.2.1, <1.5.0
- node-mcp mcp-from-openapi >=2.3.0, <2.5.0
Timeline
- 2026-06-22: disclosed: Initially disclosed in GitHub Advisory Database
- 2026-09-11: advisory: Advisory published as GHSA-65h7-9wrw-629c / CVE-2026-59973
- 2026-09-11: patched: Patched versions released: frontmcp 1.5.0, @frontmcp/adapters 1.5.0, mcp-from-openapi 2.5.0