mcp-from-openapi CVE-2026-115751

Exploitation requires that the operator has configured refResolution.blockedHosts and relies on it as a host guard, and that the attacker controls the OpenAPI spec URL passed to fromURL or a redirect target it follows. The bypass is fully effective when allowInternalIPs:true, because blockedHosts is then the only host guard; when allowInternalIPs:false only public, name-blocked hosts are reachable because the resolved-IP range check still applies. The attacker appends a trailing root dot to the blocked hostname (host. ), which must resolve in DNS to the same target as host. Limiting factors: this is a defense-in-depth gap depending on non-default reliance on blockedHosts, the impact is limited to fetching content (low confidentiality, no integrity or availability effect), and it is fixed by normalizing (lowercasing and stripping trailing dots/IPv6 brackets) on both sides of the comparison in 2.9.0; the vendor's fix is the complete remediation.

This is a moderate, defense-in-depth SSRF issue rather than an emergency. The supplied CVSS 4.0 vector (6.3, AV:N/AC:L/AT:P/PR:N/UI:N) reports a network-reachable flaw with limited confidentiality impact only (VC:L; VI/VA:N) and an attack requirement present (AT:P), which reflects dependence on how the operator configures and relies on the blockedHosts denylist and on DNS resolving the trailing-dot form. No KEV listing and no EPSS score were provided in the input, so there is no signal of active or probable widespread exploitation; the vuln.today Decision label is 'this_month', i.e. patch on a normal monthly cadence, not act_now/emergency. The reporter (VulnCheck, via the GHSA advisory) independently rated this issue low and the related credential-forwarding issue medium-low. Signals are consistent: a medium CVSS, no exploitation evidence, limited (read/fetch) impact, and a conditional trigger all point to a real-but-not-urgent priority. One scoping caveat: the GHSA advisory bundles two defects (caller-header forwarding across cross-origin redirects, CWE-522/CWE-183, and the trailing-dot blockedHosts bypass), whereas this CVE's description and CWE-184 cover only the trailing-dot denylist bypass - treat the header-forwarding fix as a related change in the same 2.9.0 release rather than part of this CVE's scored impact.

An operator loads OpenAPI specs via OpenAPIToolGenerator.fromURL and configures refResolution.blockedHosts to keep the loader away from sensitive internal hosts (most dangerous when allowInternalIPs:true, where the denylist is the only host guard). An attacker who controls the spec URL or a redirect target points it at a blocked hostname with a trailing root dot (e.g. http://internal.corp.:port/spec.json); the exact-string denylist check does not normalize the dot, so the fetch proceeds and the content of the operator-blocked host is retrieved. Reproduction steps are described in the vendor advisory, but no public, verified working exploit is published.