CVE-2026-50143
Actor MCP path authority injection leaks Apify token
Description
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.
INFO
Published Date :
Aug. 18, 2026, 6:17 p.m.
Last Modified :
Oct. 22, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Apify MCP server to version 0.10.11.
- Verify actor definition origins are validated.
- Sanitize user-controlled path components.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-50143.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-50143 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-50143
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-50143 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-50143 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 22, 2026
Action Type Old Value New Value Added Translation Title: apify-mcp-server de apify, Description: El servidor Apify MCP permite a los agentes de IA extraer datos de sitios web utilizando raspadores, rastreadores y herramientas de automatización prefabricados disponibles en la Tienda Apify. Antes de la versión 0.10.11, getActorMCPServerURL en src/mcp/actors.ts concatena la URL de reserva de Actor de confianza con la webServerMcpPath controlada por el atacante de una definición de Actor sin verificar el origen resultante, lo que permite a un editor de Actor malicioso usar un valor de autoridad de estilo userinfo para redirigir connectMCPClient a un host de terceros. Las rutas de carga de herramientas call-actor, fetch-actor-details y actor-mcp pasan esta URL a los transportes en src/mcp/client.ts que adjuntan el token portador de autorización de la víctima, exponiendo el token de la API de Apify y permitiendo el acceso a Actores, datos almacenados y cómputo facturable. Una víctima debe invocar o inspeccionar el Actor controlado por el atacante. Este problema está solucionado en la versión 0.10.11. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 18, 2026
Action Type Old Value New Value Added Reference https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm Added SSVC {'id': 'CVE-2026-50143', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-18T19:30:04.304975Z'} -
New CVE Received by [email protected]
Aug. 18, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'apify', 'product': 'apify-mcp-server', 'versions': [{'status': 'affected', 'version': '< 0.10.11'}]}] Added Description The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Added CWE CWE-918 Added Reference https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c Added Reference https://github.com/apify/apify-mcp-server/pull/927 Added Reference https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11 Added Reference https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm