Skip to content
Threat Feed
Subscribe

Vendor

Apify

1 brief RSS
high advisory

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

An attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in `@apify/actors-mcp-server` version `0.10.7` by crafting a malicious Actor definition to inject an arbitrary authority into a URL, causing the MCP client to exfiltrate the victim's Apify API token to the attacker's server, granting full access to their Apify account.

@apify/actors-mcp-server ssp-injection ssrf token-exfiltration npm-package cloud saas
3t 2i