CVE-2026-50143: Apify MCP Server Auth Bypass Vulnerability

CVE-2026-50143 Overview

CVE-2026-50143 is a server-side request forgery (SSRF) vulnerability [CWE-918] in the Apify Model Context Protocol (MCP) server. The Apify MCP server enables AI agents to invoke scrapers, crawlers, and automation tools hosted on the Apify Store. Versions prior to 0.10.11 concatenate a trusted Actor standby URL with an attacker-controlled webServerMcpPath value without validating the resulting origin. A malicious Actor publisher can supply a userinfo-style authority (for example @attacker.example/...) to redirect the MCP client to a third-party host. That host then receives the victim's Apify Authorization bearer token attached by the MCP transport.

Critical Impact
A crafted Actor definition can exfiltrate a victim's Apify API token, granting attackers access to Actors, stored datasets, and billable compute resources.

Affected Products

Apify MCP Server versions prior to 0.10.11
apify-mcp-serversrc/mcp/actors.ts — getActorMCPServerURL function
apify-mcp-serversrc/mcp/client.ts — connectMCPClient transport paths

Discovery Timeline

2026-08-18 - CVE-2026-50143 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-50143

Vulnerability Analysis

The flaw resides in getActorMCPServerURL inside src/mcp/actors.ts. The function builds an MCP endpoint by string-concatenating a trusted standby URL with mcpServerPath, a value taken from an Actor's webServerMcpPath field. Because the resulting string is never re-parsed and its origin is never compared to the standby origin, path-like inputs that begin with @host/..., .host/..., //host/..., or https://host/... cause the URL to resolve to an attacker-controlled authority.

The malicious URL then flows into connectMCPClient in src/mcp/client.ts through the call-actor, fetch-actor-details, and actor-mcp tool-loading paths. These transports unconditionally attach the caller's Apify Authorization bearer token, delivering the credential to the attacker's host. Successful exploitation requires the victim to invoke or inspect the attacker-published Actor.

Root Cause

The root cause is missing origin validation on untrusted input used to construct an outbound URL. String concatenation bypasses WHATWG URL parsing semantics, allowing userinfo-style values in webServerMcpPath to hijack the effective host component while still appearing path-like to a casual reader.

Attack Vector

An attacker publishes an Actor to the Apify Store with a crafted webServerMcpPath field. When a victim's AI agent invokes the Actor through the MCP server, the MCP client opens a transport to the attacker-controlled host and forwards the victim's bearer token in the Authorization header. The attacker replays that token against the Apify API.

typescript

// Security patch in src/mcp/actors.ts (commit ef686d7)
// Validates webServerMcpPath stays within the Actor standby origin
export async function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string> {
    const standbyBaseUrl =
        process.env.HOSTNAME === 'mcp-securitybyobscurity.apify.com'
            ? 'securitybyobscurity.apify.actor'
            : 'apify.actor';

    // Parse the standby URL up front so origin comparison uses normalised values.
    const standby = new URL(`${await getActorStandbyURL(realActorId, standbyBaseUrl)}/`);

    const resolved = new URL(mcpServerPath, standby);
    if (resolved.origin !== standby.origin) {
        throw new Error(`Actor ${realActorId} declares a webServerMcpPath that resolves outside its standby origin`);
    }
    // Strip any surviving userinfo; credentials must never appear in the URL handed to the MCP client.
    resolved.username = '';
    resolved.password = '';
}

Source: GitHub Commit ef686d7

Detection Methods for CVE-2026-50143

Indicators of Compromise

Outbound HTTPS connections from MCP client hosts to domains other than apify.actor or securitybyobscurity.apify.actor during Actor invocation.
Apify API activity originating from unfamiliar IP addresses shortly after an agent invoked a third-party Actor.
Actor manifests where webServerMcpPath contains @, //, ., or a scheme prefix such as https://.

Detection Strategies

Inspect Actor definitions for webServerMcpPath values that do not begin with a single forward slash followed by a path segment.
Log the fully resolved MCP transport URL before establishing a connection and alert when its origin diverges from the standby origin.
Correlate MCP client egress traffic against an allow-list of known Apify standby hostnames.

Monitoring Recommendations

Enable Apify audit logs and monitor for API token usage from unexpected source IPs or user agents.
Rotate Apify API tokens on a defined cadence and after any suspected exposure.
Alert on new or updated third-party Actors invoked by production AI agents.

How to Mitigate CVE-2026-50143

Immediate Actions Required

Upgrade apify-mcp-server to version 0.10.11 or later.
Rotate all Apify API tokens that were configured in MCP clients before the upgrade.
Audit recent invocations of third-party Actors and review associated egress traffic.

Patch Information

The fix is delivered in Apify MCP Server v0.10.11 and implemented in pull request #927. The patch parses webServerMcpPath with the WHATWG URL API, rejects any resolved URL whose origin differs from the Actor standby origin, and strips any userinfo components. Full details are available in GitHub Security Advisory GHSA-6gr2-qh89-hxwm.

Workarounds

Restrict AI agents to a curated allow-list of trusted Actors until the upgrade is complete.
Configure network egress policies that only permit MCP clients to reach *.apify.actor hosts.
Scope Apify API tokens to the minimum permissions required and disable unused capabilities.

bash

# Upgrade the Apify MCP server to the fixed release
npm install @apify/mcp-server@0.10.11

# Verify the installed version
npm ls @apify/mcp-server