EUVD-2026-290266

fkie_cve-2026-39885

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.

GHSA-v6ph-xcq9-qxxj — mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

Affected: npm: mcp-from-openapi, npm: @frontmcp/sdk, npm: @frontmcp/adapters

## Summary

The `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications.

## Affected Versions

`<= 2.1.2` (latest)

## CWE

CWE-918: Server-Side Request Forgery (SSRF)

## Vulnerability Details

**File:** `index.js` lines 870-875

When `OpenAPIToolGenerator.initialize()` is called, it dereferences the OpenAPI document using `json-schema-ref-parser`:

```javascript this.dereferencedDocument = await import_json_schema_ref_parser.default.dereference( JSON.parse(JSON.stringify(this.document)) ); ```

No options are passed to `.dereference()` — no URL allowlist, no custom resolvers, no protocol restrictions. The ref parser fetches any URL it encounters in `$ref` values, including:

- `http://` and `https://` URLs (internal services, cloud metadata) - `file://` URLs (local filesystem)

This is the default behavior of `json-schema-ref-parser` — it resolves all `$ref` pointers by fetching the referenced resource.

## Exploitation

### Attack 1: SSRF to internal services / cloud metadata

A malicious OpenAPI sp…

Most recent entries from all

EUVD-2026-290266

fkie_cve-2026-39885

GHSA-v6ph-xcq9-qxxj — mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications