CVE-2026-46341

{
  "id": "CVE-2026-46341",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T18:16:43.913",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates allowlisted documentation domains with String.startsWith() rather than URL hostname comparison, allowing attacker-controlled URLs such as `https://docs.apify.com.evil.com/` and `https://[email protected]/` to pass the ALLOWED_DOC_DOMAINS check and return arbitrary fetched content to the LLM. This issue is fixed in version 0.9.21."
    },
    {
      "lang": "es",
      "value": "El servidor Apify MCP permite a los agentes de IA extraer datos de sitios web utilizando scrapers, crawlers y herramientas de automatización prefabricados disponibles en la Tienda Apify. Antes de la versión 0.9.21, la herramienta fetch-apify-docs en src/tools/common/fetch_apify_docs.ts valida los dominios de documentación en lista blanca con String.startsWith() en lugar de la comparación de nombre de host de URL, permitiendo que URLs controladas por el atacante, como ’https://docs.apify.com.evil.com/’ y ’https://[email protected]/’, pasen la verificación ALLOWED_DOC_DOMAINS y devuelvan contenido arbitrario obtenido al LLM. Este problema está solucionado en la versión 0.9.21."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "apify",
          "product": "apify-mcp-server",
          "versions": [
            {
              "version": "< 0.9.21",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T14:01:40.675260Z",
          "id": "CVE-2026-46341",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-183"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apify/apify-mcp-server/commit/e39bdee530da1db0b3b3d3713558b33c9608e629",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apify/apify-mcp-server/pull/781",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apify/apify-mcp-server/releases/tag/v0.9.21",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apify/apify-mcp-server/security/advisories/GHSA-jwp7-wg77-3w9v",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/apify/apify-mcp-server/security/advisories/GHSA-jwp7-wg77-3w9v",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}