CyberSecBulletin

Frontmcp vulnerabilities

We track 2 vulnerabilities in Frontmcp products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.

2vulnerabilities
0critical
2high
0exploited
8.0average CVSS score

Latest Frontmcp vulnerabilities

  • 8.5 High severity

    frontmcp: Server-Side Request Forgery

    CVE-2026-59973Agentfront

    FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted

  • 7.5 High severity

    frontmcp: Server-Side Request Forgery

    CVE-2026-39885Agentfront

    FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions