Adapters: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
The OpenAPI adapter in @frontmcp/adapters versions prior to 1.5.6 contains a Server-Side Request Forgery (SSRF) vulnerability in its spec-change poller. While the initial spec load is protected by an SSRF guard, the recurring poller fetches the spec URL using an unguarded global fetch, bypassing protections such as allow-list/block-list enforcement, internal IP blocking, DNS resolution pinning, and redirect validation. This allows an attacker who can influence the spec URL to cause the server to make unauthorized GET requests to internal or otherwise protected network resources. The vulnerability primarily impacts confidentiality by enabling reading of internal endpoints, including cloud metadata services. The issue is fixed in version 1.5.6 by routing the poller's fetch through the same SSRF guard as the initial load.
AI Analysis
Technical Summary
The OpenAPI adapter's spec-change poller (OpenApiSpecPoller) in @frontmcp/adapters versions <= 1.5.5 performs recurring fetches of the configured spec URL using the raw global fetch() function, bypassing the SSRF guard applied during the initial spec load. This omission disables protections such as host allow/block lists, internal/private IP blocking, DNS resolution pinning, and redirect validation. Consequently, when polling is enabled and the spec URL is attacker-influenceable or untrusted, the server issues unguarded GET requests on every poll interval to potentially internal or sensitive endpoints. The vulnerability allows unauthorized reading of internal services, including cloud instance metadata endpoints, leading to potential credential or token theft. The patch in version 1.5.6 ensures the poller uses the same SSRF guard as the initial load, closing this attack vector.
Potential Impact
Exploitation requires polling enabled and an untrusted or attacker-controllable spec URL. The server will make repeated unguarded GET requests to the specified URL, which can resolve to internal or private network addresses. This can lead to unauthorized access to internal services, cloud metadata endpoints (e.g., 169.254.169.254), and internal network scanning. The primary impact is confidentiality loss due to unauthorized reading of internal resources. Integrity and availability impacts are not indicated. The vulnerability does not affect servers polling fixed, trusted spec URLs in practice but represents a risk if the URL is attacker-influenceable.
Mitigation Recommendations
A fix is available in @frontmcp/adapters version 1.5.6 and later. The patch routes the poller's fetch through the same SSRF guard as the initial spec load, enforcing allow/block lists, IP blocking, DNS pinning, and redirect validation. Users should upgrade to version 1.5.6 or later to remediate this vulnerability. If upgrading is not immediately possible, disabling polling or ensuring the spec URL is fixed and fully trusted can mitigate risk. Patch status is confirmed by the vendor advisory. No additional mitigation is required once patched.
Adapters: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Description
The OpenAPI adapter in @frontmcp/adapters versions prior to 1.5.6 contains a Server-Side Request Forgery (SSRF) vulnerability in its spec-change poller. While the initial spec load is protected by an SSRF guard, the recurring poller fetches the spec URL using an unguarded global fetch, bypassing protections such as allow-list/block-list enforcement, internal IP blocking, DNS resolution pinning, and redirect validation. This allows an attacker who can influence the spec URL to cause the server to make unauthorized GET requests to internal or otherwise protected network resources. The vulnerability primarily impacts confidentiality by enabling reading of internal endpoints, including cloud metadata services. The issue is fixed in version 1.5.6 by routing the poller's fetch through the same SSRF guard as the initial load.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenAPI adapter's spec-change poller (OpenApiSpecPoller) in @frontmcp/adapters versions <= 1.5.5 performs recurring fetches of the configured spec URL using the raw global fetch() function, bypassing the SSRF guard applied during the initial spec load. This omission disables protections such as host allow/block lists, internal/private IP blocking, DNS resolution pinning, and redirect validation. Consequently, when polling is enabled and the spec URL is attacker-influenceable or untrusted, the server issues unguarded GET requests on every poll interval to potentially internal or sensitive endpoints. The vulnerability allows unauthorized reading of internal services, including cloud instance metadata endpoints, leading to potential credential or token theft. The patch in version 1.5.6 ensures the poller uses the same SSRF guard as the initial load, closing this attack vector.
Potential Impact
Exploitation requires polling enabled and an untrusted or attacker-controllable spec URL. The server will make repeated unguarded GET requests to the specified URL, which can resolve to internal or private network addresses. This can lead to unauthorized access to internal services, cloud metadata endpoints (e.g., 169.254.169.254), and internal network scanning. The primary impact is confidentiality loss due to unauthorized reading of internal resources. Integrity and availability impacts are not indicated. The vulnerability does not affect servers polling fixed, trusted spec URLs in practice but represents a risk if the URL is attacker-influenceable.
Mitigation Recommendations
A fix is available in @frontmcp/adapters version 1.5.6 and later. The patch routes the poller's fetch through the same SSRF guard as the initial spec load, enforcing allow/block lists, IP blocking, DNS pinning, and redirect validation. Users should upgrade to version 1.5.6 or later to remediate this vulnerability. If upgrading is not immediately possible, disabling polling or ensuring the spec URL is fixed and fully trusted can mitigate risk. Patch status is confirmed by the vendor advisory. No additional mitigation is required once patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8q49-2h5h-434x
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a6542179c2644c7f8087d0e
Added to database: 07/25/2026, 23:09:11 UTC
Last enriched: 07/25/2026, 23:48:32 UTC
Last updated: 07/26/2026, 03:43:33 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.