CoreCVE
Back

MEDIUM

Activepieces: Server-side request forgery in MCP tool validation endpoint

Published Aug 11, 2026

Description

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the Activepieces server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability from the Activepieces host. This issue is fixed in version 0.82.0.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-918

SSRF

References (5)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner GitHub_M
Published Aug 11, 2026
Updated Aug 11, 2026
Reserved Aug 10, 2026
Link CVE-2026-73082

CISA Vulnrichment

Updated Aug 11, 2026

NVD

Status Deferred
Modified Sep 9, 2026
Link CVE-2026-73082

Red Hat

No data

ENISA EUVD

Assigner GitHub_M
Published Aug 11, 2026
Updated Aug 11, 2026
Link EUVD-2026-56534

GitHub

No data