Server-side Request Forgery (SSRF)

Overview @apify/actors-mcp-server is an Apify MCP Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webServerMcpPath field in the Actor definition, which is concatenated with a trusted base URL without proper validation. An attacker can cause...

PT-2026-55219

Name of the Vulnerable Software and Affected Versions @apify/actors-mcp-server versions prior to 0.10.11 Description An authority injection issue exists where the software constructs Actor standby URLs by concatenating a trusted base URL with an attacker-controlled webServerMcpPath variable witho...