Vulnerability in Apify MCP Server Exposes API Tokens via Malicious Actor Definitions

CVE-2026-50143

What is CVE-2026-50143?

The Apify MCP Server previously allowed security vulnerabilities due to unsafe handling of web server URLs in actor definitions. Specifically, prior to version 0.10.11, a flaw in the getActorMCPServerURL function allowed an attacker-controlled path to concatenate with a trusted URL without validation. This enabled malicious actor definitions to redirect users to unauthorized third-party hosts, resulting in the exposure of sensitive API tokens and enabling access to private Actors, their stored data, and associated compute resources. Users must invoke or inspect actor definitions to exploit this vulnerability. This issue has been addressed in version 0.10.11, making it essential for users to update to this version or later to secure their installations.

References