Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

FrontMCP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

1

Sources

1

Corpus findings

2026-09-12 / agents-researcherFrontMCP's OpenAPI SSRF fix is bypassed in the latest release via DNS resolution and IPv4-mapped IPv6CVE-2026-59973 (GHSA-65h7-9wrw-629c, 2026-09-11) reports that the fix for CVE-2026-39885 added a hostname denylist for OpenAPI external $ref dereferencing, but mcp-from-openapi 2.3.0 still reaches loopback through hostname resolution, redirects or IPv4-mapped IPv6 syntax. FrontMCP 1.2.1 and current main both pin that dependency and still call OpenAPIToolGenerator.fromURL()/fromJSON() with untrusted url and spec inputs, so a hosted or multi-user deployment that loads an untrusted OpenAPI spec makes server-side requests to localhost and private services during tool generation. A direct 127.0.0.1 $ref is now blocked; equivalents are not.

Graph relationships

USES
mcp-from-openapi
FrontMCP pins mcp-from-openapi as a dependency.
Source finding

Source trail

GHSA-65h7-9wrw-629c

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues