PT-2026-64041 · Work90210 · Apifold

CVE-2026-47769 · Publicado 2026-07-23 · Atualizado 2026-07-23

NVD

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the /webhooks/:serverSlug/:eventName endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the webhook events PostgreSQL table without any signature check or authentication requirement. The root cause is that createWebhookRouter is called at server.ts:188 without a validators map, so receivers.ts:80's optional-chaining guard evaluates to undefined and the signature-validation block (receiver.ts:81–95) is unconditionally skipped. Any unauthenticated network client that knows a valid server slug can inject arbitrary payloads, which are subsequently served as trusted resource state to legitimate MCP clients. Commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 patches the issue.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-47769

Produtos afetados

Apifold

Referências · 4

• https://github.com/Work90210/APIFold/pull/235 · Nota
• https://github.com/Work90210/APIFold/commit/7f19b52280f414f57af2b79a95333d1c8fbeece5 · Nota
• https://github.com/Work90210/APIFold/security/advisories/GHSA-x82h-9r8v-m672 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-47769 · Nota de Segurança