The vulnerability is caused by concatenating a trusted Actor standby URL with an attacker-controlled webServerMcpPath without validating the resulting origin. This allows a malicious Actor publisher to embed a userinfo-style authority component that redirects the MCP client to a third-party host. As a result, the client sends the victim's Authorization bearer token to that host, leaking the Apify API token and granting unauthorized access to Actors, stored data, and billed compute.

Apify MCP Server versions earlier than 0.10.11 are affected. The flaw exists in all releases before the revision that introduced the URL origin validation in getActorMCPServerURL.

The flaw has a CVSS score of 8.1, indicating high severity. EPSS information is not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack requires a victim to invoke or inspect a malicious Actor definition, so exploitation is more likely in environments that allow anonymous or untrusted Actor uploads. The fixed code in 0.10.11 isolates the client from external hosts, preventing token leakage.