EUVD-2026-67148
GHSA-gghj-77w7-6r3h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint, no auth required (PR:N); impact is confidentiality-only via credential disclosure; no integrity or availability effect, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool.
AnalysisAI
Server-Side Request Forgery in Apify actors-mcp-server allows any MCP caller to make the server fetch arbitrary internal URLs, including cloud instance metadata endpoints, exposing IAM credentials. The get-html-skeleton tool's URL validation in src/tools/common/get_html_skeleton.ts accepted any syntactically valid http/https URL without inspecting the destination hostname or resolved address, permitting requests to loopback, link-local, and RFC 1918 ranges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The get-html-skeleton tool must be loaded by the MCP server - it is included in default configurations and requires no special enablement flag. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N yielding 8.7 accurately reflects a no-authentication, no-complexity network exploit with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to an Apify MCP server running a pre-0.9.12 version calls the get-html-skeleton tool with the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the argument. The server's URL validator accepts the link-local address as syntactically valid, passes it to the internal browser actor, and returns the IAM role credential payload in the tool response. … |
| Remediation | Upgrade to Apify actors-mcp-server version 0.9.12 or later, which removes the get-html-skeleton tool entirely as confirmed by PR #572 (https://github.com/apify/apify-mcp-server/pull/572) and advisory GHSA-m28f-9v8h-gg2f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Apify actors-mcp-server and determine their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today