GHSA-6gr2-qh89-hxwm: Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
A vulnerability in @apify/actors-mcp-server version prior to 0.10.11 allows an attacker to inject a malicious path in the Actor MCP URL construction. This injection causes the MCP client to send the victim's Apify API token to an attacker-controlled host due to improper URL concatenation and lack of origin validation. The issue arises from treating userinfo in URLs incorrectly, leading to token leakage. The vulnerability has a high severity score of 8.1 CVSS v3.1 and affects versions before 0.10.11.
AI Analysis
Technical Summary
@apify/actors-mcp-server versions before 0.10.11 build Actor standby URLs by concatenating a trusted base URL with an attacker-controlled webServerMcpPath from the Actor definition. This path is not validated to ensure it is a relative path or same-origin, allowing an attacker to craft a path containing '@' that injects a different authority (host) into the URL. The MCP client then sends the victim's Apify API token in the Authorization header to this attacker-controlled host. The vulnerability stems from improper URL construction and lack of origin checks, leading to exfiltration of sensitive tokens. The flaw is documented in CVE-2026-50143 with a CVSS v3.1 base score of 8.1 (High).
Potential Impact
An attacker who publishes a malicious Actor with a crafted webServerMcpPath can cause the victim's Apify API token to be sent to an attacker-controlled server. This token leakage can lead to unauthorized access to the victim's Apify account and resources. The vulnerability does not affect availability but impacts confidentiality and integrity due to token exposure and potential misuse.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted Actor definitions or untrusted webServerMcpPath values. Monitor for updates from the @apify/actors-mcp-server maintainers and apply patches once released. Do not rely on the MCP client to validate or sanitize the webServerMcpPath field.
GHSA-6gr2-qh89-hxwm: Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
Description
A vulnerability in @apify/actors-mcp-server version prior to 0.10.11 allows an attacker to inject a malicious path in the Actor MCP URL construction. This injection causes the MCP client to send the victim's Apify API token to an attacker-controlled host due to improper URL concatenation and lack of origin validation. The issue arises from treating userinfo in URLs incorrectly, leading to token leakage. The vulnerability has a high severity score of 8.1 CVSS v3.1 and affects versions before 0.10.11.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
@apify/actors-mcp-server versions before 0.10.11 build Actor standby URLs by concatenating a trusted base URL with an attacker-controlled webServerMcpPath from the Actor definition. This path is not validated to ensure it is a relative path or same-origin, allowing an attacker to craft a path containing '@' that injects a different authority (host) into the URL. The MCP client then sends the victim's Apify API token in the Authorization header to this attacker-controlled host. The vulnerability stems from improper URL construction and lack of origin checks, leading to exfiltration of sensitive tokens. The flaw is documented in CVE-2026-50143 with a CVSS v3.1 base score of 8.1 (High).
Potential Impact
An attacker who publishes a malicious Actor with a crafted webServerMcpPath can cause the victim's Apify API token to be sent to an attacker-controlled server. This token leakage can lead to unauthorized access to the victim's Apify account and resources. The vulnerability does not affect availability but impacts confidentiality and integrity due to token exposure and potential misuse.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted Actor definitions or untrusted webServerMcpPath values. Monitor for updates from the @apify/actors-mcp-server maintainers and apply patches once released. Do not rely on the MCP client to validate or sanitize the webServerMcpPath field.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6gr2-qh89-hxwm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-50143"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a45998227e9c797194186cb
Added to database: 07/01/2026, 22:49:38 UTC
Last enriched: 07/01/2026, 22:49:44 UTC
Last updated: 07/01/2026, 22:49:57 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.