CVE-2026-39885
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The mcp-from-openapi library in FrontMCP prior to version 2.3.0 does not restrict $ref dereferencing in OpenAPI specifications, enabling SSRF and local file read attacks when processing untrusted specifications.
Risk Assessment
An attacker can use a malicious OpenAPI specification to access internal network resources or read files on the server.
Recommendation
Update FrontMCP to version 2.3.0 or later, which includes the fix.
Other vulnerabilities in FrontMCP
See all- CVE-2026-67531Critical
FrontMCP prior to 1.5.7 has a vulnerability in the codecall:execute tool that allows sandbox escape and remote code execution. By exploiting Zod objects, a script can access the Function constructor and execute arbitrary code in the server process. A single tools/call is sufficient to achieve full compromise.
- CVE-2026-59973High
In mcp-from-openapi (2.3.0–2.5.0) and frontmcp and @frontmcp/adapters (1.2.1–1.5.0), loadOpenAPISpec() forwards untrusted OpenAPI URLs and inputs to the tool generator without proper destination validation. The external $ref guard only checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirects, or normalizing IPv4-mapped IPv6. An authenticated user able to import an OpenAPI specification can force requests to internal services.
Original NVD description (English source)
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS