CVE-2026-73082 in Activepieces
Summary
by MITRE • 08/12/2026
Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the Activepieces server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability from the Activepieces host. This issue is fixed in version 0.82.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described represents a critical server-side request forgery (SSRF) flaw in Activepieces AI workflow automation platform affecting versions prior to 082.0. This security weakness resides within the POST endpoint /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool which processes user-supplied serverUrl parameters without adequate validation mechanisms. The flaw allows authenticated attackers to manipulate the application's outbound network requests, potentially enabling them to probe internal network services and bypass security controls that would normally prevent direct access to internal resources.
The technical implementation of this vulnerability stems from insufficient input validation and sanitization practices within the platform's API endpoint handling logic. When a user submits a request to validate an agent MCP tool, the system accepts the serverUrl parameter directly without performing proper URL format verification or implementing network access restrictions. This design flaw creates an attack surface where malicious actors can specify arbitrary URLs that the Activepieces server will attempt to connect to, effectively turning the platform into a potential reconnaissance tool for internal network mapping and service enumeration.
The operational impact of this vulnerability extends beyond simple network probing capabilities and represents a significant risk to organizational security infrastructure. An authenticated user can leverage this flaw to access cloud metadata endpoints such as AWS Instance Metadata Service or Azure Instance Metadata Service, potentially extracting sensitive credentials and configuration data. Additionally, the vulnerability enables attackers to probe internal services that may not be exposed to external networks but are accessible from the Activepieces server host, creating opportunities for further exploitation and lateral movement within the network environment.
This vulnerability aligns with CWE-918 which specifically addresses Server-Side Request Forgery vulnerabilities where applications fail to properly validate user-supplied URLs before making outbound requests. The flaw also maps to ATT&CK technique T1071.004 for application layer protocol tunneling, as the vulnerability enables attackers to establish connections through the Activepieces server that would otherwise be blocked by network security controls. Organizations utilizing Activepieces versions prior to 082.0 face potential exposure to credential theft, internal network reconnaissance, and privilege escalation attacks if this vulnerability is exploited.
The recommended mitigation strategy involves upgrading to Activepieces version 0.82.0 or later, which includes proper URL validation mechanisms and SSRF protection measures. Security teams should also implement network-level restrictions such as outbound firewall rules that prevent the Activepieces server from connecting to internal services or metadata endpoints. Additionally, organizations should consider implementing API rate limiting and monitoring for unusual outbound connection patterns to detect potential exploitation attempts. Regular security audits of third-party integrations and dependency updates remain essential practices to maintain overall platform security posture against similar vulnerabilities.