Agentfront mcp-from-openapi versions 2.2.0 through 2.8.x contain a server-side request forgery flaw that lets an attacker bypass the ssrf.blockedHosts deny‑list by appending a trailing‑dot to a hostname that is normally blocked. The vulnerability allows the application to resolve and fetch content from hosts that the operator intended to block, exposing internal resources or sensitive data. The weakness is identified as CWE‑184, describing insecure handling of URL parsing.

The affected product is Agentfront’s mcp-from-openapi, a server component that processes OpenAPI specifications. Versions 2.2.0 up to, but not including, 2.9.0 are vulnerable. Systems that host or load custom OpenAPI documents or redirect targets from untrusted sources are at risk. The schema indicates a typical dependency on the frontmcp platform.

The CVSS score of 6.3 places the vulnerability in the medium severity band. EPSS is not available, so the probable exploitation frequency cannot be quantified, and it is not listed in the CISA KEV catalog. Attackers need control over the OpenAPI spec URL or a redirect target; once provided, they can craft a URL that includes a trailing dot to resolve to a blocked host, triggering an SSRF. The exploit is straightforward for users with sufficient privileges or ability to supply specifications, making it a feasible attack path in environments where spec inputs are not strictly validated.