CVE-2026-73082 Activepieces: Server-side request forgery in MCP tool validation endpoint

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can...

CVE-2026-73082

Activepieces (open source AI workflow automation) has an SSRF vulnerability in the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint. Before version 0.82.0, an authenticated user could cause the server to issue outbound HTTP or SSE requests to a user-supplied serverUrl ...