CVE-2026-39885

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
agentfront	frontmcp	< 1.0.4
@frontmcp	adapters	< 1.0.4
@frontmcp	sdk	< 1.0.4
frontmcp	mcp-from-openapi	< 2.3.0

References

https://github.com/agentfront/frontmcp/releases/tag/v1.0.4Product
https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxjExploit, Vendor Advisory
https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxjExploit, Vendor Advisory

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-398865.3OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2026-398889.9PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sa CVE-2026-398897.5PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activi CVE-2026-39897.8SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take adva CVE-2026-398909.8PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML CVE-2026-398918.8PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) th CVE-2026-398929.8cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a n CVE-2026-398939.8Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatena CVE-2026-398942.5Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in CVE-2026-398976.1Cacti is an open source performance and fault management framework. Versions 1.2.30 and below contain a Reflected XSS vulnerability in the h CVE-2026-398995.3Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename CVE-2026-39904.3A security flaw has been discovered in CesiumGS CesiumJS up to 1.137.0. Affected by this issue is some unknown functionality of the file App