GHSA-jwp7-wg77-3w9v: Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

Summary

The fetch-apify-docs tool in the Apify Model Context Protocol (MCP) server checks URLs against a domain allowlist with String.startsWith() instead of comparing hostnames. An attacker can use a URL such as https://docs.apify.com.evil.com/ to pass the check and have the tool return attacker-controlled page content to the LLM. The advisory notes this enables prompt injection and can direct the LLM to use a victim's _meta.apifyToken in call-actor invocations.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online