FrontMCP's OpenAPI SSRF fix is bypassed in the latest release via DNS resolution and IPv4-mapped IPv6

GitHub Security Advisories·low signalXBlueskyLinkedInCopy link

CVE-2026-59973 (GHSA-65h7-9wrw-629c, 2026-09-11) reports that the fix for CVE-2026-39885 added a hostname denylist for OpenAPI external $ref dereferencing, but mcp-from-openapi 2.3.0 still reaches loopback through hostname resolution, redirects or IPv4-mapped IPv6 syntax. FrontMCP 1.2.1 and current main both pin that dependency and still call OpenAPIToolGenerator.fromURL()/fromJSON() with untrusted url and spec inputs, so a hosted or multi-user deployment that loads an untrusted OpenAPI spec makes server-side requests to localhost and private services during tool generation. A direct 127.0.0.1 $ref is now blocked; equivalents are not.