CVE-2026-59973

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

Summary

The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.

FrontMCP latest release v1.2.1 and current main still call OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON() from mcp-from-openapi 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.

This is a latest-version bypass of the previous fix. A direct http://127.0.0.1 $ref control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.

Latest versions checked

• frontmcp npm latest: 1.2.1
• @frontmcp/adapters npm latest: 1.2.1
• mcp-from-openapi npm latest: 2.3.0
• FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944
• FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756

The release tag and current main both keep mcp-from-openapi 2.3.0 in package.json and libs/adapters/package.json, and both keep the OpenAPI adapter forwarding untrusted url, spec, and loadOptions.refResolution into OpenAPIToolGenerator.

Technical details

FrontMCP's OpenAPI adapter reaches the affected dependency paths:

• libs/adapters/src/openapi/openapi.adapter.ts imports OpenAPIToolGenerator from mcp-from-openapi.
• loadOpenAPISpec() calls OpenAPIToolGenerator.fromURL(this.options.url, ...) and forwards loadOptions.refResolution.
• The same method calls OpenAPIToolGenerator.fromJSON(this.options.spec, ...) and forwards loadOptions.refResolution.

In mcp-from-openapi 2.3.0, the patched guard is applied before the HTTP resolver fetches an external $ref. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.

As a result, these URLs are accepted by the guard but cause a loopback request from the backend:

• http://127.0.0.1.nip.io:<port>/schema.json, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.
• http://127.0.0.1.nip.io:<port>/redirect, because the first host passes and the actual request follows a redirect to http://127.0.0.1:<port>/schema.json.
• http://[::ffff:127.0.0.1]:<port>/schema.json and http://[::ffff:7f00:1]:<port>/schema.json, because IPv4-mapped IPv6 loopback is not normalized and denied.

OpenAPIToolGenerator.fromURL() is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external $ref fix bypass.

Reproduction

The attached local PoC starts a loopback canary and loads generated OpenAPI specs using mcp-from-openapi 2.3.0. The request body schema contains a single external $ref for each test case. The canary records every backend-origin request.

Run:

cd /home/unkn0wn/security_audit/frontmcp-ssrf-poc
node repro-frontmcp-latest-ssrf-bypasses.mjs

Important output from a fresh run on 2026-05-25:

{"name":"direct-127-denied-control","kind":"external_ref","refUrl":"http://127.0.0.1:45117/schema.json","ok":false,"hitCount":0,"hits":[]}
{"name":"dns-name-to-127-bypass","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}…

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.

Summary

The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external $ref dereferencing, but the latest patched dependency mcp-from-openapi 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.

FrontMCP latest release v1.2.1 and current main still call OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON() from mcp-from-openapi 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.

This is a latest-version bypass of the previous fix. A direct http://127.0.0.1 $ref control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.

Latest versions checked

• frontmcp npm latest: 1.2.1
• @frontmcp/adapters npm latest: 1.2.1
• mcp-from-openapi npm latest: 2.3.0
• FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944
• FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756

The release tag and current main both keep mcp-from-openapi 2.3.0 in package.json and libs/adapters/package.json, and both keep the OpenAPI adapter forwarding untrusted url, spec, and loadOptions.refResolution into OpenAPIToolGenerator.

Technical details

FrontMCP's OpenAPI adapter reaches the affected dependency paths:

• libs/adapters/src/openapi/openapi.adapter.ts imports OpenAPIToolGenerator from mcp-from-openapi.
• loadOpenAPISpec() calls OpenAPIToolGenerator.fromURL(this.options.url, ...) and forwards loadOptions.refResolution.
• The same method calls OpenAPIToolGenerator.fromJSON(this.options.spec, ...) and forwards loadOptions.refResolution.

In mcp-from-openapi 2.3.0, the patched guard is applied before the HTTP resolver fetches an external $ref. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.

As a result, these URLs are accepted by the guard but cause a loopback request from the backend:

• http://127.0.0.1.nip.io:<port>/schema.json, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.
• http://127.0.0.1.nip.io:<port>/redirect, because the first host passes and the actual request follows a redirect to http://127.0.0.1:<port>/schema.json.
• http://[::ffff:127.0.0.1]:<port>/schema.json and http://[::ffff:7f00:1]:<port>/schema.json, because IPv4-mapped IPv6 loopback is not normalized and denied.

OpenAPIToolGenerator.fromURL() is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external $ref fix bypass.

Reproduction

The attached local PoC starts a loopback canary and loads generated OpenAPI specs using mcp-from-openapi 2.3.0. The request body schema contains a single external $ref for each test case. The canary records every backend-origin request.

Run:

cd /home/unkn0wn/security_audit/frontmcp-ssrf-poc
node repro-frontmcp-latest-ssrf-bypasses.mjs

Important output from a fresh run on 2026-05-25:

{"name":"direct-127-denied-control","kind":"external_ref","refUrl":"http://127.0.0.1:45117/schema.json","ok":false,"hitCount":0,"hits":[]}
{"name":"dns-name-to-127-bypass","kind":"external_ref","refUrl":"http://127.0.0.1.nip.io:45117/schema.json","ok":true,"hitCount":1,"hits":[{"url":"/schema.json","host":"127.0.0.1.nip.io:45117","authorization":null}]}…