agentfront has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 3.7 (low). Most affected products: mcp-from-openapi (2), frontmcp (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.7
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-59973High· 8.5FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP)59CVE-2026-115751Low· 3.7mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname20CVE-2026-115750Low· 3.7mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects20
agentfront vulnerabilities
CVEs affecting agentfront, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-115751Low· 3.7mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname
Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec U…
CVE-2026-115750Low· 3.7mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a …
CVE-2026-59973High· 8.5PoCFrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP)
FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISp…