Activepieces, an open‑source AI workflow automation platform, has a server‑side request forgery flaw in the MCP tool validation endpoint. The vulnerable POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool allows an authenticated user to submit an arbitrary serverUrl that the server then requests without any validation; this can lead the Activepieces host to connect to internal services, cloud metadata endpoints, or any external host, thereby exposing internal network information or facilitating lateral movement.

All Activepieces installations running a version older than 0.82.0 are affected. The flaw resides in the server component that handles the MCP tool validation request, which is available to any user who can authenticate and provide a project ID.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated internal exploitation, as an attacker must first log into the Activepieces instance to send the crafted POST request. No public exploits have been reported, but the flaw can cause the server to reach arbitrary URLs, potentially exposing internal host details and enabling lateral movement.