Mcp From Openapi
Monthly
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.
SSRF denylist bypass in the npm package mcp-from-openapi (2.2.0 through 2.8.0) lets an attacker who controls the OpenAPI spec URL passed to fromURL - or a redirect target it follows - reach hosts the operator listed in refResolution.blockedHosts simply by appending a trailing root dot (http://internal.corp./), because DNS resolves the dotted FQDN to the same host while the library compares raw URL.hostname strings. The same release range separately forwarded caller-supplied Authorization and Cookie headers to cross-origin redirect targets, handing bearer tokens to an open redirect on the spec host. Impact is limited to fetching operator-blocked content (low confidentiality, no integrity or availability effect), exploitation depends on non-default reliance on blockedHosts as the host guard, no CISA KEV listing exists, and the upstream advisory documents proof-of-concept reproductions; 2.9.0 normalizes hostnames on both sides of the comparison and drops caller headers once a redirect leaves the spec origin.
Credential exposure in the npm package mcp-from-openapi (versions 2.5.0 up to but not including 2.9.0) lets a malicious or compromised spec host harvest the caller's Authorization, Cookie and Proxy-Authorization headers, because the library's manual redirect loop in safeFetch() re-sends those headers unchanged to every hop - including hops that leave the spec URL's origin, which native fetch would strip. An attacker who controls the host serving the OpenAPI document, or who can exploit an open redirect on that host, receives the bearer token or cookie that the caller supplied to fromURL(); impact is confidentiality-only and bounded to the single credential handed over (higher only when that token is high-privilege), and no leak occurs when no credential headers are passed or when followRedirects is disabled. The same advisory bundles a lower-severity blockedHosts denylist bypass (a trailing root dot, e.g. http://internal.corp./, fails the exact-string comparison), relevant only to deployments that rely on blockedHosts with allowInternalIPs enabled. A vendor fix is available in 2.9.0; no public exploit code was identified at time of analysis, though the upstream advisory documents reproduction steps, and the vendor rates the issue CVSS 4.0 6.3 while our independent assessment scores it CVSS 3.1 5.9-class AV:N/AC:H with low confidentiality impact only.