CVE-2026-73082: Activepieces SSRF Vulnerability

CVE-2026-73082 Overview

Activepieces is an open source AI workflow automation platform. CVE-2026-73082 is a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.82.0. The POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint issues an outbound HTTP or Server-Sent Events (SSE) request to a user-supplied serverUrl without URL validation or SSRF protection. Authenticated users can coerce the Activepieces server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts. The flaw enables network reachability probing from the Activepieces host. The issue is fixed in version 0.82.0.

Critical Impact
An authenticated attacker can pivot the Activepieces server to reach internal-only services and cloud instance metadata endpoints, exposing credentials and enabling internal network reconnaissance.

Affected Products

Activepieces open source AI workflow automation platform
Activepieces versions prior to 0.82.0
Deployments exposing the /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint

Discovery Timeline

2026-08-11 - CVE-2026-73082 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73082

Vulnerability Analysis

The vulnerability resides in the MCP (Model Context Protocol) tool validation endpoint. This endpoint accepts a serverUrl parameter from an authenticated user and initiates an outbound HTTP or SSE connection to that URL. The server performs no allowlist checks, no scheme validation, and no filtering of internal or link-local IP ranges.

The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. An attacker with a valid project-scoped account can direct the server to probe 169.254.169.254 (cloud metadata), 127.0.0.1 (loopback services), or internal RFC1918 addresses. Response timing and error content can be used to enumerate reachable hosts and open ports.

Root Cause

The controller handling validate-agent-mcp-tool passes the caller-supplied URL directly to the HTTP client without invoking any SSRF filter. The fix introduces a shared safeHttp axios instance and routes validation through a dedicated mcpToolValidator. The patched endpoint additionally collapses all failure modes into a single generic error to prevent oracle-style port and network reconnaissance.

Attack Vector

Exploitation requires an authenticated user with the WRITE_FLOW permission on a project. The attacker submits a crafted MCP tool configuration whose serverUrl points to an internal resource. The Activepieces backend performs the request server-side, returning tool metadata or an error whose characteristics reveal reachability information.

typescript

// Patched controller (post-fix) — packages/server/api/src/app/agents/agent-tools-controller.ts
import { AgentMcpTool, ApId, Permission, PrincipalType } from '@activepieces/shared'
import { FastifyPluginAsyncZod } from 'fastify-type-provider-zod'
import { z } from 'zod'
import { ProjectResourceType } from '../core/security/authorization/common'
import { securityAccess } from '../core/security/authorization/fastify-security'
import { mcpToolValidator } from './mcp-tool-validator'

export const agentToolsController: FastifyPluginAsyncZod = async (app) => {
    app.post('/mcp/validate', ValidateMcpToolRequest, async (req) => {
        return mcpToolValidator.validateAgentMcpTool(req.body)
    })
}

const ValidateMcpToolRequest = {
    config: {
        security: securityAccess.project(
            [PrincipalType.USER],
            Permission.WRITE_FLOW,
            { type: ProjectResourceType.PARAM },
        ),
    },
    schema: {
        tags: ['agent'],
        description: 'Probe an external MCP server configured as an agent tool and return its tool names. The outbound call is routed through the SSRF-filtered safeHttp axios; all failure modes collapse to a single generic error so the response cannot be used for port or network reconnaissance.',
        params: z.object({ projectId: ApId }),
        body: AgentMcpTool,
    },
}

Source: Activepieces commit d385079

Detection Methods for CVE-2026-73082

Indicators of Compromise

Outbound HTTP or SSE requests from the Activepieces host to 169.254.169.254, 127.0.0.1, or RFC1918 ranges originating from the MCP validation endpoint.
Application logs showing repeated POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool calls with varying serverUrl values.
Unexpected DNS lookups from the Activepieces backend for internal hostnames or cloud metadata endpoints.

Detection Strategies

Inspect reverse proxy and web server logs for requests to the vulnerable endpoint containing internal IPs or metadata URLs in the JSON body.
Correlate outbound connection telemetry from the Activepieces host with authenticated session activity in the application.
Alert on any egress from the Activepieces workload to cloud metadata services or loopback-adjacent addresses.

Monitoring Recommendations

Deploy egress filtering at the workload level and log all denied connections for review.
Monitor for anomalous outbound connection volume or destination diversity from the Activepieces process.
Review MCP tool configurations across projects for serverUrl values pointing to non-public addresses.

How to Mitigate CVE-2026-73082

Immediate Actions Required

Upgrade Activepieces to version 0.82.0 or later, which routes the validation call through the SSRF-filtered safeHttp client.
Restrict outbound network access from the Activepieces host to only the destinations required for legitimate workflow execution.
Audit historical MCP tool configurations and validation requests for suspicious serverUrl values.

Patch Information

The fix is available in Activepieces Release 0.82.0. Technical details are documented in GitHub Security Advisory GHSA-7qx9-q4xx-rh59 and Pull Request #12721. The patch introduces a shared safeHttp axios instance and unifies all failure paths into a single generic error to prevent reconnaissance oracles.

Workarounds

Block outbound access from the Activepieces backend to 169.254.169.254, loopback, and internal subnets using host or network firewall rules.
Place the Activepieces workload in a network segment with strict egress policies until the upgrade is applied.
Disable or restrict access to the MCP tool validation endpoint via a reverse proxy rule where operationally feasible.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP