Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81093— Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

Quick assessment

Affected
apify actors-mcp-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

工具在仅校验了 URL 的语法之后，便抓取了调用者提供的 URL。位于 中的处理程序使用 中的 对 参数进行了验证，该函数仅确认字符串以 或 协议开头，并且可以被解析为一个 URL，但并未检查其主机名或该 URL 解析到的实际地址。因此，回环地址、链路本地地址以及私有地址范围均能通过校验，其中包括云服务商用于提供实例元数据的地址（如 ）。由于该 URL 未做进一步检查就被传递给 web-browser 执行器，抓取到的文档内容会直接返回在工具响应中，这意味着 MCP 服务器的任何调用方都可以让服务器请求仅主机端可达

CVSS 8.6 · High

Possible ATT&CK Techniques 2 AI

T1041 · Exfiltration Over C2 Channel T1015

Affected Version Matrix 1

VendorProduct Version RangeStatus
apify actors-mcp-server < 0.9.12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81093

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton
Source: CVE Program / CVE List V5
Vulnerability Description
The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
apify actors-mcp-server 0 ~ 0.9.12 -

II. Public POCs for CVE-2026-81093

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81093

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81093 (2)

IV. Related Vulnerabilities

Same vendor: apify
Same weakness: CWE-918

V. Comments for CVE-2026-81093

No comments yet

Leave a comment