CVE-2026-46341

MediumCVSS 6.1

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Apify MCP server before version 0.9.21 has a vulnerability in the fetch-apify-docs tool where String.startsWith() is used instead of URL hostname comparison for domain validation. This allows attacker-controlled URLs to bypass the allowed domain list and return arbitrary content to the LLM.

Risk Assessment

An attacker can feed false or malicious content to the AI model, potentially leading to misinformation, data theft, or manipulation of the AI agent's actions.

Recommendation

Immediately update the Apify MCP server to version 0.9.21 or later, which includes the domain validation fix.

Other vulnerabilities in Apify MCP server

CVE-2026-50143High
The Apify MCP server before version 0.10.11 does not verify the origin of the URL in getActorMCPServerURL, allowing a malicious actor publisher to redirect the connection to a third-party host. As a result, the victim's Apify API token may be exposed, enabling access to actors, data, and billable compute.

Original NVD description (English source)

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates allowlisted documentation domains with String.startsWith() rather than URL hostname comparison, allowing attacker-controlled URLs such as `https://docs.apify.com.evil.com/` and `https://[email protected]/` to pass the ALLOWED_DOC_DOMAINS check and return arbitrary fetched content to the LLM. This issue is fixed in version 0.9.21.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS