Executive brief
FrontMCP is a Node.js framework that exposes APIs as AI tools. Its OpenAPI adapter periodically re-fetches OpenAPI specifications to detect updates, but the polling mechanism bypassed security checks that prevent Server-Side Request Forgery (SSRF) attacks. An attacker who controls or influences a spec URL can cause the server to make unguarded HTTP requests to internal cloud metadata services, internal networks, or private IP addresses—potentially stealing credentials or discovering internal systems.
Technical details
FrontMCP's OpenAPI adapter uses a spec-change poller (OpenApiSpecPoller) that re-fetches a configured OpenAPI spec URL on a timer using a raw global fetch() call. This bypass the safeFetch() / assertUrlSafe() SSRF guard that protects the initial spec load via OpenAPIToolGenerator.fromURL(). The vulnerable code path lacks all protections: no IP blocklist enforcement, no internal/cloud-metadata/CGNAT blocking, no DNS pinning, and no per-hop redirect validation. An attacker-influenceable spec URL (user-supplied, tenant-supplied, or redirected by an attacker) can point to internal addresses like 169.254.169.254 (AWS metadata endpoint) or 127.0.0.1. Each polling interval issues an unguarded GET request, enabling credential theft and network reconnaissance. Patch 1.5.6 and later route polling through the same safeFetch guard as the initial load.
Affected products
- FrontMCP adapters <=1.5.5
Timeline
- 2026-07-24: disclosed