Server-Side Request Forgery Vulnerability in Agentfront's mcp-from-openapi Product

CVE-2026-115751

What is CVE-2026-115751?

The mcp-from-openapi product from Agentfront versions prior to 2.9.0 contains a server-side request forgery vulnerability. This issue allows attackers to circumvent the ssrf.blockedHosts denylist by leveraging trailing-dot hostnames. If an attacker has control over an OpenAPI specification URL or the target of a redirect, they can exploit this vulnerability to gain unauthorized access to blocked hosts by appending a root dot to the blocked hostname, potentially leading to the exposure of sensitive information.

References