Executive brief
The Apify MCP Server's get-html-skeleton tool allowed callers to make it fetch any HTTP(S) URL after validating only the URL syntax, without checking the host or resolved address. An attacker could exploit this to retrieve sensitive data from cloud instance metadata services or other internal endpoints reachable only from the host, potentially obtaining credentials and other secrets. The tool was removed in version 0.9.12.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in src/tools/common/get_html_skeleton.ts. The URL validation in isValidHttpUrl (src/utils/generic.ts) only checked that the URL string began with http/https and parsed correctly, without verifying the hostname or resolved address. This allowed requests to loopback (127.0.0.1), link-local, and private IP ranges (10.0.0.0/8, etc.), including cloud provider metadata endpoints (e.g., 169.254.169.254). The unchecked URL was passed directly to a web-browser actor, which fetched the document and returned it to the caller. Any client of the MCP server could invoke this tool to read responses from internal-only endpoints, including instance credentials. The fix in version 0.9.12 removes the tool entirely.
Affected products
- Apify MCP Server before 0.9.12
Timeline
- 2026-08-27: disclosed
- 2026-08-27: patched: Tool removed in version 0.9.12