{"id":"CVE-2026-115751","kind":"vulnerability","aliases":["CVE-2026-115751"],"related":[],"title":"mcp-from-openapi: trailing-dot hostnames bypass SSRF blocklist","description":"Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.","summary":"mcp-from-openapi, a tool that turns OpenAPI specs into MCP servers, has a server-side request forgery flaw in versions 2.2.0 before 2.9.0. An attacker who controls an OpenAPI spec URL or a redirect target can append a trailing dot to a blocked hostname to make the server fetch content from hosts the operator meant to block.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","node","openapi","self-hosted"],"not_affected_if":["default-config","fixed-trusted-specs"],"how_to_check":"- Check the installed version of `mcp-from-openapi` in each project's lockfile or `package.json`, looking for versions from `2.2.0` up to but not including `2.9.0`.\n- Look for the `ssrf.blockedHosts` setting in your configuration to see whether you rely on the denylist.","fix":"- Upgrade `mcp-from-openapi` to `2.9.0` or later.\n- Until upgraded, do not load OpenAPI specs or follow redirects from untrusted sources.","status":"open","published_at":"2026-10-23T13:17:09+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:00:03+00:00","updated_at":"2026-10-25T04:00:03+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T04:00:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `mcp-from-openapi` to `2.9.0` or later.\n- Until upgraded, do not load OpenAPI specs or follow redirects from untrusted sources.","reach":"network","title":"mcp-from-openapi: trailing-dot hostnames bypass SSRF blocklist","impact":"medium","summary":"mcp-from-openapi, a tool that turns OpenAPI specs into MCP servers, has a server-side request forgery flaw in versions 2.2.0 before 2.9.0. An attacker who controls an OpenAPI spec URL or a redirect target can append a trailing dot to a blocked hostname to make the server fetch content from hosts the operator meant to block.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","openapi","node","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"server fetches content from operator-blocked internal hosts","analyst_note":"Check the NVD entry and the upstream advisory or fix commit for the exact affected range and whether the blocklist is on by default.","how_to_check":"- Check the installed version of `mcp-from-openapi` in each project's lockfile or `package.json`, looking for versions from `2.2.0` up to but not including `2.9.0`.\n- Look for the `ssrf.blockedHosts` setting in your configuration to see whether you rely on the denylist.","needs_analyst":true,"not_affected_if":["fixed-trusted-specs","default-config"],"who_is_affected":"Teams that run mcp-from-openapi at a version from 2.2.0 up to but not including 2.9.0 and that use the ssrf.blockedHosts denylist to keep the server away from internal hosts are exposed. The risk applies when attackers can supply the OpenAPI spec URL or influence a redirect target. Deployments that only load trusted, fixed specs can deprioritize it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3363,"output_tokens":695,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115751':14A,17A '-2026':13A,16A '2.2.0':50B,93C '2.9.0':52B,95C 'agentfront':87C 'ai':19B 'ai-tool':18B 'allow':105C 'append':66B,128C 'attack':54B,106C,117C 'block':72B,86B,134C,142C 'blocklist':11A 'bypass':9A,108C 'contain':96C 'content':79B,138C 'control':56B,119C 'cve':12A,15A 'denylist':111C 'dot':7A,69B,115C,131C 'fetch':78B,137C 'flaw':47B 'forgeri':46B,102C 'host':26B,81B,143C 'hostnam':8A,73B,116C,135C 'make':75B 'mcp':2A,21B,28B,38B,89C 'mcp-from-openapi':1A,27B,88C 'meant':84B 'node':22B 'openapi':4A,23B,30B,35B,58B,91C,121C 'oper':83B,141C 'operator-block':140C 'redirect':63B,125C 'request':45B,101C 'root':130C 'self':25B 'self-host':24B 'server':39B,43B,77B,99C 'server-sid':42B,98C 'side':44B,100C 'spec':36B,59B,122C 'ssrf':10A 'ssrf.blockedhosts':110C 'target':64B,126C 'tool':20B,32B 'trail':6A,68B,114C 'trailing-dot':5A,113C 'turn':34B 'url':60B,123C 'use':112C 'version':49B 'vulner':103C","nicknames":[],"mitigations":[],"who_affected":"Teams that run mcp-from-openapi at a version from 2.2.0 up to but not including 2.9.0 and that use the ssrf.blockedHosts denylist to keep the server away from internal hosts are exposed. The risk applies when attackers can supply the OpenAPI spec URL or influence a redirect target. Deployments that only load trusted, fixed specs can deprioritize it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115751","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115751","severity":null,"published_at":"2026-10-23T13:17:09+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}