CVE-2026-115751 in mcp-from-openapi
Summary
by MITRE • 10/23/2026
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/24/2026
The Agentfront mcp-from-openapi library, specifically versions prior to 2.9.0 starting from version 2.2.0, contains a critical server-side request forgery vulnerability rooted in the improper validation of hostnames during URL processing. This flaw allows attackers who have control over an OpenAPI specification URL or can influence redirect targets to bypass security controls designed to restrict outbound network connections. The core technical issue lies in how the application resolves and validates domain names against a denylist, commonly referred to as ssrf.blockedHosts. By appending a trailing dot to a blocked hostname, such as example.com becoming example.com., an attacker can exploit differences in DNS resolution behavior or string matching logic within the validation routine. In many systems, a trailing dot signifies that the name is fully qualified and should not be appended with any local domain suffixes during resolution. However, if the security filter performs a simple substring match or fails to normalize hostnames before comparison, it may treat example.com. as distinct from example.com, thereby allowing the request to proceed despite being intended for a blocked destination.
This vulnerability falls under the category of CWE-918 Server-Side Request Forgery (SSRF), which occurs when a web application fetches a remote resource without validating the user-supplied URL. The specific mechanism here involves an insufficient validation of hostnames, categorized as CWE-20 Improper Input Validation. By leveraging this flaw, attackers can bypass organizational security policies that restrict access to internal networks or sensitive external services. This capability enables unauthorized data exfiltration from internal systems, exploitation of backend services that are not exposed to the public internet, and potential pivoting within a network environment where SSRF is typically mitigated by strict allowlists or denylists. The impact is particularly severe in environments relying on OpenAPI specifications for dynamic API integration, as these specs often dictate which endpoints an application will interact with programmatically.
From an offensive security perspective, this vulnerability aligns with the MITRE ATT&CK technique T1571 Non-Standard Port Communication and potentially T1090 Proxy, depending on how the forged requests are routed. Attackers can use this method to probe internal network segments that would otherwise be inaccessible due to firewall rules or application-level restrictions. The ability to fetch content from operator-blocked hosts means that sensitive information stored in internal databases, configuration files, or administrative interfaces could be retrieved and exfiltrated by malicious actors. This undermines the principle of least privilege and compromises the integrity of the system's network boundary defenses.
To mitigate this vulnerability, organizations must upgrade the Agentfront mcp-from-openapi library to version 2.9.0 or later, where the issue has been addressed through improved hostname normalization and validation logic. In addition to upgrading, developers should implement robust input sanitization that normalizes all hostnames by stripping trailing dots before performing denylist checks. It is also advisable to employ a whitelist approach for outbound connections rather than relying solely on denylists, as allowlisting known safe destinations provides stronger security guarantees. Furthermore, integrating network-level controls such as egress filtering and monitoring outbound traffic patterns can help detect and block attempts to access unauthorized resources even if application-layer defenses are bypassed. Regularly auditing OpenAPI specifications for malicious or unexpected URL references is also recommended to prevent the introduction of SSRF vectors through configuration files.