CVE-2026-54660: swagger-typescript-api Token Leak Issue

CVE-2026-54660 Overview

CVE-2026-54660 is an information disclosure vulnerability [CWE-200] in swagger-typescript-api, a tool that generates API clients for Fetch or Axios from OpenAPI specifications. Versions prior to 13.12.2 forward the --authorizationToken header to every URL fetched during remote schema resolution. An attacker who controls an OpenAPI specification can include external $ref URLs pointing to attacker-controlled endpoints. When a developer or CI pipeline processes the spec, the bearer token is sent cross-origin. The issue is fixed in version 13.12.2.

Critical Impact
Attacker-controlled OpenAPI specifications can exfiltrate developer or CI/CD bearer tokens to arbitrary cross-origin endpoints during client code generation.

Affected Products

swagger-typescript-api versions prior to 13.12.2
Developer workstations running the CLI against untrusted OpenAPI specs
CI/CD pipelines invoking the tool with --authorizationToken

Discovery Timeline

2026-07-29 - CVE-2026-54660 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-54660

Vulnerability Analysis

The vulnerability resides in src/resolved-swagger-schema.ts, specifically the getRemoteRequestHeaders function. This function attaches the value of --authorizationToken to every outbound HTTP request made by fetchRemoteSchemaDocument. The warmUpRemoteSchemasCache routine walks the OpenAPI specification and resolves each external $ref URL it encounters. Because the token is not scoped to the original host, any host referenced by a $ref receives the credential.

An attacker who publishes or provides an OpenAPI schema can embed a $ref pointing to a domain they control. When a developer runs the generator with a bearer token to fetch a private schema, the tool blindly reuses that token when following external references. The captured token can then be replayed against the legitimate API.

Root Cause

The root cause is missing origin validation on credential propagation. The header assembly logic does not compare the target URL's origin against the origin associated with the token. This design assumes all referenced schemas are trusted, which breaks the moment any external $ref is honored.

Attack Vector

Exploitation requires a victim to run the generator against a spec that contains an attacker-controlled $ref. The vector is network based and requires user interaction, but no privileges are needed on the target system. The confidentiality impact is high because bearer tokens frequently grant broad access to internal APIs.

typescript

// Patch excerpt from src/code-gen-process.ts
import { JavascriptTranslator } from "./translators/javascript.js";
import type { TranslatorIO } from "./translators/translator.js";
import { TypeNameFormatter } from "./type-name-formatter.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
import { FileSystem } from "./util/file-system.js";
import { createLodashCompat } from "./util/lodash-compat.js";
import { NameResolver } from "./util/name-resolver.js";

Source: GitHub Commit 306d59a

Detection Methods for CVE-2026-54660

Indicators of Compromise

Outbound HTTPS requests from developer or build agents to domains not on an approved schema-host allow list.
OpenAPI specifications containing $ref values that reference external, unrelated domains.
Authorization: Bearer headers observed in requests to hosts other than the original schema origin.

Detection Strategies

Inspect OpenAPI files for cross-origin $ref URLs before running swagger-typescript-api in any pipeline.
Audit CI/CD build logs for network egress performed by the code generator step and correlate against expected hosts.
Enumerate installed versions of swagger-typescript-api across developer environments and identify any below 13.12.2.

Monitoring Recommendations

Route CI outbound traffic through an egress proxy and alert on requests to unapproved domains during code generation.
Monitor secret managers for bearer tokens used by build pipelines and rotate on any anomalous access.
Log and review npx swagger-typescript-api invocations, capturing the schema URL and any --authorizationToken usage.

How to Mitigate CVE-2026-54660

Immediate Actions Required

Upgrade swagger-typescript-api to version 13.12.2 or later in all developer and CI environments.
Rotate any bearer tokens that were passed to the CLI via --authorizationToken against untrusted or externally sourced specs.
Review recent build logs for unexpected outbound requests initiated by the generator.

Patch Information

The fix is included in swagger-typescript-api v13.12.2. Technical details are available in the GHSA-h754-fxp7-88wx advisory and the pull request #1779. The patch prevents the authorization token from being forwarded to hosts that differ from the original schema origin.

Workarounds

Avoid passing --authorizationToken when processing OpenAPI specs from untrusted sources.
Pre-process schemas to strip or resolve external $ref URLs before invoking the generator.
Isolate code generation inside a sandboxed container with strict egress rules limited to the schema host.

bash

# Upgrade to the patched version
npm install --save-dev swagger-typescript-api@^13.12.2

# Verify installed version
npx swagger-typescript-api --version