CVE-2026-59973: FrontMCP OpenAPI Adapter SSRF Vulnerability

CVE-2026-59973 Overview

CVE-2026-59973 is a Server-Side Request Forgery (SSRF) vulnerability in FrontMCP, a TypeScript-first framework for the Model Context Protocol (MCP). The flaw affects mcp-from-openapi versions 2.3.0 through 2.4.x and frontmcp / @frontmcp/adapters versions 1.2.1 through 1.4.x. The loadOpenAPISpec() function in libs/adapters/src/openapi/openapi.adapter.ts forwards untrusted OpenAPI URL and spec inputs to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON() without adequate address validation. Authenticated users in hosted or multi-user deployments can pivot backend requests to internal services, exposing administrative APIs, cloud metadata endpoints, and private network resources.

Critical Impact
An authenticated attacker can coerce the backend into issuing requests to internal-only services, exposing cloud metadata endpoints, internal admin APIs, and other private network resources [CWE-918].

Affected Products

mcp-from-openapi versions 2.3.0 up to (but not including) 2.5.0
frontmcp versions 1.2.1 up to (but not including) 1.5.0
@frontmcp/adapters versions 1.2.1 up to (but not including) 1.5.0

Discovery Timeline

2026-09-15 - CVE-2026-59973 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-59973

Vulnerability Analysis

The vulnerability sits in the OpenAPI adapter's spec-loading path. loadOpenAPISpec() accepts a caller-supplied URL and forwards it, along with loadOptions.refResolution, to the underlying OpenAPIToolGenerator. The external $ref guard inspects only the parsed hostname string. It does not resolve DNS, pin validated addresses, revalidate redirect targets, or normalize IPv4-mapped IPv6 forms.

This gap creates several SSRF primitives. An attacker can register a hostname whose DNS resolves to 127.0.0.1, use an attacker-controlled HTTP endpoint that redirects to a loopback address, or encode loopback as an IPv4-mapped IPv6 literal such as ::ffff:127.0.0.1. In each case the hostname check passes while the actual outbound socket lands on an internal service.

Root Cause

The root cause is incomplete SSRF validation [CWE-918]. Hostname-string checks alone cannot enforce network-boundary policy because name-to-address resolution happens later, in a separate call, and can differ from the string inspected by the guard. Redirect handling compounds the issue by revalidating only the initial URL, not the final destination.

Attack Vector

Exploitation requires an authenticated user who can import or configure an OpenAPI specification. The attacker supplies a spec URL or an inline spec containing external $ref entries pointing to a hostname under their control. The backend performs DNS resolution, follows redirects, and issues requests from its own network position, reaching services such as 169.254.169.254 (cloud instance metadata) or internal admin endpoints bound to loopback.

typescript

// Patch from libs/adapters/src/openapi/openapi.adapter.ts
// Secure default: disable external $ref resolution unless explicitly opted in.
private resolveRefResolution(): NonNullable<OpenApiAdapterOptions['loadOptions']>['refResolution'] {
  return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
}

private async initializeGenerator(): Promise<OpenAPIToolGenerator> {
  const refResolution = this.resolveRefResolution();

  if ('url' in this.options) {
    return await OpenAPIToolGenerator.fromURL(this.options.url, {
      baseUrl: this.options.baseUrl,
      validate: this.options.loadOptions?.validate ?? true,
      dereference: this.options.loadOptions?.dereference ?? true,
      headers: this.options.loadOptions?.headers,
      timeout: this.options.loadOptions?.timeout,
      // followRedirects and refResolution now flow through the SSRF-hardened path
    });
  }
}
// Source: https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d

The upstream mcp-from-openapi fix introduces a dedicated SsrfError class and exports SSRF primitives such as assertUrlSafe, safeFetch, isBlockedAddress, isBlockedHostname, and decodeIpv4MappedIpv6. See the mcp-from-openapi SSRF patch for the full implementation.

Detection Methods for CVE-2026-59973

Indicators of Compromise

Outbound HTTP requests from FrontMCP hosts to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 originating from OpenAPI spec loading.
Spec URLs or $ref targets containing IPv4-mapped IPv6 literals such as ::ffff:127.0.0.1 or [::ffff:a9fe:a9fe].
HTTP redirect chains where the initial hostname is public but the final resolved address is private or loopback.

Detection Strategies

Log every URL passed to OpenAPIToolGenerator.fromURL() and every external $ref resolved during spec parsing, including resolved IP addresses.
Alert on FrontMCP process connections to cloud metadata IPs (169.254.169.254, fd00:ec2::254) or to RFC1918 ranges not part of the expected upstream API set.
Correlate authenticated user actions that import OpenAPI specs with subsequent backend network egress to internal ranges.

Monitoring Recommendations

Enable egress filtering on the FrontMCP service account and monitor for denied connections to internal ranges.
Track occurrences of LoadError and the new SsrfError (after upgrade) in application logs and alert on non-zero rates.
Audit user-supplied OpenAPI specs for external $ref fields prior to loading.

How to Mitigate CVE-2026-59973

Immediate Actions Required

Upgrade mcp-from-openapi to 2.5.0 and frontmcp / @frontmcp/adapters to 1.5.0.
Restrict OpenAPI spec import and configuration to trusted administrators until the upgrade is deployed.
Apply network-layer egress controls that block the FrontMCP backend from reaching loopback, link-local, RFC1918, and cloud metadata addresses.

Patch Information

The issue is resolved in mcp-from-openapi 2.5.0 and frontmcp / @frontmcp/adapters 1.5.0. The fix disables external $ref resolution by default (allowedProtocols: []), DNS-resolves spec URLs before fetching, blocks internal addresses, and revalidates redirect targets. See the GitHub Security Advisory GHSA-65h7-9wrw-629c, frontmcp v1.5.0 release, and mcp-from-openapi v2.5.0 release.

Workarounds

Explicitly set loadOptions.refResolution.allowedProtocols to [] to disable external $ref resolution.
Limit OpenAPI spec configuration to a single trusted local administrator role.
Deploy FrontMCP in a network segment where egress to internal management planes and metadata services is denied at the firewall.

bash

# Upgrade to patched versions
npm install mcp-from-openapi@^2.5.0
npm install frontmcp@^1.5.0 @frontmcp/adapters@^1.5.0

# Verify secure default in adapter configuration
# loadOptions.refResolution.allowedProtocols should be [] unless external refs are required