EUVD-2026-338468

fkie_cve-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates allowlisted documentation domains with String.startsWith() rather than URL hostname comparison, allowing attacker-controlled URLs such as `https://docs.apify.com.evil.com/` and `https://docs.apify.com@evil.com/` to pass the ALLOWED_DOC_DOMAINS check and return arbitrary fetched content to the LLM. This issue is fixed in version 0.9.21.

GHSA-jwp7-wg77-3w9v — Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

Affected: npm: @apify/actors-mcp-server

### Summary The `fetch-apify-docs` tool validates URLs against a domain allowlist using `String.startsWith()` instead of proper URL hostname comparison. This allows bypass via attacker-controlled subdomains (e.g., `https://docs.apify.com.evil.com/`), enabling the tool to fetch and return arbitrary web content to the LLM.

### Details #### Vulnerable component

`src/tools/common/fetch_apify_docs.ts`, line 51:

```typescript const isAllowedDomain = ALLOWED_DOC_DOMAINS.some((domain) => url.startsWith(domain)); ```

`src/const.ts`, lines 167-170:

```typescript export const ALLOWED_DOC_DOMAINS = [ 'https://docs.apify.com', 'https://crawlee.dev', ] as const; ```

#### How the bypass works

`String.startsWith('https://docs.apify.com')` matches any string beginning with that prefix, including:

- `https://docs.apify.com.evil.com/payload` - attacker-controlled subdomain - `https://docs.apify.com@evil.com/payload` - userinfo component in URL (browser behavior varies, but `fetch()` in Node.js may follow this) - `https://docs.apify.com.evil.com:8080/path` - custom port on attacker domain

All of these pass the `startsWith` check because they begin with the exact string `https://docs.apify.com`.

#### The fetched content is returned to the LLM

After the allowlist check passes, the tool fetches the URL and returns the full page content as markdown (`fetch_apify_docs.ts:69-103`):

```typescript const response = await fetch(url); // ... const html = await response.text(); markdown…

Most recent entries from all

EUVD-2026-338468

fkie_cve-2026-46341

GHSA-jwp7-wg77-3w9v — Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching