CVE-2026-39885

HighCVSS 7.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

The mcp-from-openapi library in FrontMCP prior to version 2.3.0 does not restrict $ref dereferencing in OpenAPI specifications, enabling SSRF and local file read attacks when processing untrusted specifications.

Risk Assessment

An attacker can use a malicious OpenAPI specification to access internal network resources or read files on the server.

Recommendation

Update FrontMCP to version 2.3.0 or later, which includes the fix.

Other vulnerabilities in FrontMCP

CVE-2026-67531Critical
FrontMCP prior to 1.5.7 has a vulnerability in the codecall:execute tool that allows sandbox escape and remote code execution. By exploiting Zod objects, a script can access the Function constructor and execute arbitrary code in the server process. A single tools/call is sufficient to achieve full compromise.

Original NVD description (English source)

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the initialize() call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. This vulnerability is fixed in 2.3.0.