Threats Tagged 'ghsa-wfcf-h98w-gp9m'

Agentfront mcp-from-openapi versions from 2.2.0 up to but not including 2.9.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to bypass the denylist of blocked hosts by appending a trailing dot to hostnames, enabling unauthorized requests to operator-blocked hosts. The vulnerability arises from incomplete filtering of disallowed inputs in the OpenAPI specification URL or redirect targets.