The Apify MCP server allows AI agents to scrape websites using tools from the Apify Store. Before release 0.9.21, the fetch‑apify‑docs component validated allowlisted documentation domains with a simple string‑prefix check. This flaw meant that URLs containing the allowed prefix but pointing to another domain, for example https://docs.apify.com.evil.com/ or https://docs.apify.com@evil.com/, passed the ALLOWED_DOC_DOMAINS test and were fetched, returning arbitrary content to the LLM. The weakness combines improper input validation and unchecked hostname comparison (CWE‑183 and CWE‑20). An attacker who can influence the fetch request can thus cause the server to retrieve malicious or unrelated content and inject it into AI outputs, potentially leading to data contamination or downstream exploitation.

Apify MCP server, all released versions before 0.9.21. The vulnerability was fixed in release 0.9.21 and later. It affects the fetch‑apify‑docs component located in src/tools/common/fetch_apify_docs.ts.

The CVSS score of 6.1 indicates a moderate risk. EPSS score is < 1% (approximately 0.00191), indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation is reported yet. Based on the description, it is inferred that the attacker could launch the exploit from a client that can induce the MCP server to resolve a malicious domain or from an internal attacker who can tamper with the fetch request. The attack could be performed remotely if the fetch‑apify‑docs endpoint is exposed or internally if the attacker controls a job that invokes the function. The attack surface therefore depends on how the server is deployed and exposed to clients.