CVE-2026-115751: mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using mcp-from-openapi versions 2.2.0 through versions before 2.9.0 are affected if they rely on the ssrf.blockedHosts denylist to prevent requests to specific hosts.
What does an attacker need to exploit the bypass?
An attacker must be able to control an OpenAPI specification URL or a redirect target used by the application. They can append a trailing root dot to a hostname that the operator has blocked.
Are blocked hosts still protected by the default denylist behavior?
No. For affected versions, the ssrf.blockedHosts denylist can be bypassed when the blocked hostname is represented with a trailing dot.
What can be done before upgrading?
The provided information does not specify a workaround. Treat untrusted OpenAPI spec URLs and redirect targets as unsafe where they could cause requests to operator-blocked hosts.