@apify/actors-mcp-server versions prior to 0.10.11 construct Actor standby URLs by concatenating a trusted base URL with the `webServerMcpPath` field from an Actor definition without validating that the path is relative or free of authority injection characters such as '@'. An attacker publishing a malicious Actor with a crafted `webServerMcpPath` (e.g., '@attacker.example/mcp') causes the resulting URL to be interpreted with the attacker’s host as authority, per RFC 3986 and WHATWG URL parsing. The MCP client then attaches the victim's Apify API token as a Bearer token in the Authorization header to requests sent to the attacker’s server, resulting in token exfiltration. The vulnerability is triggered through multiple code paths that fetch the Actor definition and connect the MCP client, with no origin checks performed before sending the token. A proof-of-concept demonstrates the attack in a network-isolated Docker environment.

An attacker can exfiltrate the victim's Apify API token by publishing a malicious Actor with a crafted `webServerMcpPath`. This token leakage can lead to unauthorized access to the victim's Apify account and resources. The vulnerability does not affect availability but compromises confidentiality and integrity of the victim's credentials.

An official patch is available that fixes this vulnerability. Users should upgrade @apify/actors-mcp-server to version 0.10.11 or later. Until patched, avoid running untrusted Actors or those with unverified `webServerMcpPath` values. The vendor advisory confirms a fix is available; apply it promptly to prevent token leakage.