CVE-2026-59973

CVE-2026-59973 is a server-side request forgery (CWE-918) bypass of the previously published fix (GHSA-v6ph-xcq9-qxxj / CVE-2026-39885) for external $ref dereferencing in the mcp-from-openapi dependency used by FrontMCP's OpenAPI adapter. The fix added a denylist check on the parsed URL hostname string, but mcp-from-openapi 2.3.0 still does not resolve hostnames before validating, does not pin the validated IP to the fetch, does not revalidate redirect targets, and misses IPv4-mapped IPv6 loopback forms, so semantically equivalent loopback targets such as 127.0.0.1.nip.io, redirectors to 127.0.0.1, and [::ffff:127.0.0.1] still cause backend requests to localhost. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec (via the adapter's untrusted url, spec, and loadOptions.refResolution inputs to OpenAPIToolGenerator.fromURL()/fromJSON()) can trigger requests from the server to loopback or private internal services during tool generation, yielding high confidentiality impact and limited integrity impact per the 8.5 CVSS score. Affected are FrontMCP deployments up to and including the latest release v1.2.1 and current main, as well as any direct consumer of npm mcp-from-openapi up to 2.3.0. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is reported.

What to do: Until fixed releases beyond FrontMCP 1.2.1 and mcp-from-openapi 2.3.0 are available, avoid loading untrusted OpenAPI specs or disable external $ref resolution (refResolution) for untrusted specs, and block backend egress to loopback, link-local, and RFC1918 ranges at the network layer. Watch for patched versions of mcp-from-openapi that resolve and pin IPs and revalidate redirect targets before the fetch. Audit whether your FrontMCP deployment accepts user-supplied url or spec values in the OpenAPI adapter, as that is the required attack precondition.