CyberSecBulletin

Apify vulnerabilities

We track 2 vulnerabilities in Apify products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 27, 2026.

2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score

Latest Apify vulnerabilities

  • 8.6 High severity

    actors-mcp-server: Server-Side Request Forgery

    CVE-2026-81093Apify

    The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an

  • 8.1 High severity

    apify-mcp-server: Server-Side Request Forgery

    CVE-2026-50143Apify

    The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL