FrontMCP’s mcp‑from‑openapi library uses a JSON schema parser that dereferences $ref pointers in OpenAPI specifications without any URL restrictions or custom resolvers. When fed an untrusted specification, the parser automatically fetches the resources referenced by $ref, which can point to internal network addresses, cloud metadata endpoints, or local files. This flaw enables a malicious actor to trigger Server‑Side Request Forgery (SSRF) and read arbitrary files on the server during the library’s initialization. The weakness is a typical example of CWE‑918, exposing the application to confidentiality and potential network-breach risks.

Vulnerable versions of the FrontMCP framework include the adapters, SDK, agentfront frontmcp, and mcp‑from‑openapi components. All releases prior to version 2.3.0 of the mcp‑from‑openapi library are affected, regardless of the hosting environment. Users deploying FrontMCP with any older mcp‑from‑openapi package should consider the risk.

With a CVSS score of 7.5 the vulnerability is classified as high severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can supply a malicious OpenAPI specification to the initialize() call, meaning the attack surface is limited to environments where untrusted specs may be processed or distributed. If such input can be controlled, the attacker can cause outbound network traffic or read sensitive files, potentially leading to broader compromise.