CVE-2026-73082
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability. This issue is fixed in version 0.82.0.
Risk Assessment
The SSRF vulnerability may allow an attacker to access internal network resources or cloud metadata, potentially leading to data leakage or privilege escalation.
Recommendation
Update Activepieces to version 0.82.0 or later, which includes the fix.
Original NVD description (English source)
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the Activepieces server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability from the Activepieces host. This issue is fixed in version 0.82.0.