What happened
CVE-2026-115751 (published 2026-10-23) is a server-side request forgery in Agentfront's mcp-from-openapi MCP-spec generator. Its ssrf.blockedHosts denylist can be bypassed by appending a trailing dot to a blocked hostname (root-dot trick), so a malicious spec/redirect can steer the server into an SSRF despite the configured block list.
Why it matters
mcp-from-openapi turns untrusted OpenAPI specs into live MCP tools; a bypassed SSRF block lets an attacker-director/fetcher reach internal or cloud-metadata endpoints from the agent tool surface. Narrow exposure but a real instance of the denylist-normalization weak spot in MCP tooling.
Attack vector
An attacker who controls an OpenAPI spec URL (or an open redirect) appends a trailing root dot to a blocked hostname. Because the denylist comparison is literal, the trailing-dot hostname is treated as a different host, bypassing the SSRF block and letting the MCP server fetch attacker-chosen internal/cloud-metadata endpoints.
Affected systems
Agentfront mcp-from-openapi >= 2.2.0, < 2.9.0
Mitigation
Upgrade to mcp-from-openapi 2.9.0 (commit 47fb7a6). Until then, validate/normalize hostnames (strip trailing dots) before comparing against blockedHosts, and pin spec URLs you trust.