Executive brief
FrontMCP is a library used to integrate OpenAPI specifications into applications. A vulnerability in its background update feature allows the system to be tricked into making unauthorized requests to internal network services or cloud metadata endpoints. This could lead to the exposure of sensitive internal data, such as server credentials or private network information, if the application is configured to fetch specifications from an untrusted source.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `OpenApiSpecPoller` component of `@frontmcp/adapters`. While the initial loading of an OpenAPI specification is protected by an SSRF guard, the background polling mechanism used a raw global `fetch()` call that bypassed these protections. An attacker who can influence the specification URL can trigger periodic GET requests to internal IP addresses, loopback interfaces, or cloud metadata services (e.g., 169.254.169.254). This bypasses allow-lists, block-lists, and DNS-rebinding protections. The vulnerability is present when `polling.enabled` is set to true and the URL is attacker-controlled. The issue is fixed in version 1.5.6 by routing the poller through the same `safeFetch` guard used for initial loads.
Affected products
- FrontMCP @frontmcp/adapters <= 1.5.5
Timeline
- 2026-07-23: patched: Version 1.5.6 released
- 2026-07-24: advisory: GitHub Advisory GHSA-8q49-2h5h-434x published