APIFold CVE-2026-47769

Exploitation requires network access to the APIFold /webhooks/:serverSlug/:eventName HTTP endpoint and knowledge of at least one valid serverSlug configured on the target instance. No authentication, HMAC signature, API key, or special HTTP header is required - signature validation was architecturally absent in all pre-patch versions regardless of server configuration. The slug requirement is the sole limiting factor: if slugs follow a predictable pattern or are disclosed in client-side code, API responses, or documentation, this barrier is effectively zero. Exploitation is bounded to the integrity dimension; the CVSS vector (PR:N, UI:N) confirms no user interaction or privileges are needed. Confidentiality of existing stored data is not directly exposed, and there is no availability impact.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3 Medium) accurately captures the network-accessible, zero-complexity, unauthenticated attack surface but materially understates functional severity: injected payloads are consumed as authoritative event state by downstream MCP clients, enabling semantic poisoning of AI agent tool outputs beyond what 'I:L' implies. No EPSS score was supplied in the intelligence data, so exploitation probability cannot be quantitatively assessed. KEV status is not confirmed, and no active exploitation has been declared. The primary friction for attackers is enumerating a valid serverSlug; if slugs are predictable or exposed via API documentation, this is a negligible barrier. The fix exists only as a commit hash (not a tagged release), meaning operators must manually pin to or beyond commit 7f19b52, creating deployment risk. CVSS vector alignment with description is consistent - no conflicts identified.

An attacker identifies an APIFold deployment (e.g., via Shodan or API documentation), enumerates or guesses a valid serverSlug, and sends an unauthenticated POST request with a crafted JSON body to /webhooks/<slug>/order.created. The payload is written to Redis and the webhook_events PostgreSQL table without any signature check, and is subsequently returned as trusted event data to MCP clients, allowing the attacker to inject fabricated order confirmations, tool outputs, or instructions into AI agent workflows. No exploit code has been publicly released, but the vulnerability is trivially reproducible from the public description.