What happened
mcp-from-openapi from 2.5.0 before 2.9.0 forwards Authorization and Cookie headers on cross-origin redirects, letting an attacker controlling a spec host or an open redirect steal bearer tokens/cookies via a redirected fromURL() spec request. CVSS 3.7 (v3.1) / 6.3 (v4.0), published 2026-10-23. (A companion SSRF, CVE-2026-115751, lets a trailing-dot hostname bypass the ssrf.blockedHosts denylist.)
Why it matters
MCP-server generators fetch remote specs and attach stored credentials; a credential-forwarding defect leaks those tokens to an attacker-controlled origin, compromising the MCP server's upstream API access.
Attack vector
safeFetch() forwards Authorization and Cookie headers on cross-origin redirects (CWE-522). An attacker who controls a spec host or an open redirect can point fromURL() spec requests at their own origin to capture bearer tokens or cookies.
Affected systems
mcp-from-openapi (agentfront, npm) 2.5.0 to before 2.9.0
Mitigation
Upgrade to mcp-from-openapi 2.9.0 (GHSA-ff5q-5r4v-fw4v, commit 47fb7a655de33958b0c923490ab244343eb5fc44); only load specs from trusted hosts and strip credentials on cross-origin redirects.