CVE-2026-50143
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
The Apify MCP server before version 0.10.11 does not verify the origin of the URL in getActorMCPServerURL, allowing a malicious actor publisher to redirect the connection to a third-party host. As a result, the victim's Apify API token may be exposed, enabling access to actors, data, and billable compute.
Risk Assessment
The organization risks leaking the Apify API token, which could lead to unauthorized access to data, actors, and compute costs, as well as compromise of data processed by AI agents.
Recommendation
It is recommended to upgrade the Apify MCP server to version 0.10.11 or later and avoid using actors from unverified publishers.
Original NVD description (English source)
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.