CVE-2026-115750
Low
Description
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.
SeverityLow
CVSS3.7
Exploit probability—
ProductAgentfront Mcp-from-openapi
PublishedOct 23, 2026
First seenOct 23, 2026
Weakness typeCWE-522CWE-522
How to fix
Update
- agentfront mcp-from-openapi2.9.0 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| agentfront mcp-from-openapi | 2.5.0 ≤ v < 2.9.0 | 2.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.