CVE-2026-50143: The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation
Summary
The Apify MCP server (a tool that lets AI agents scrape and extract data from websites) had a vulnerability where malicious actors could redirect connections to fake servers and steal API tokens (security credentials that grant access to accounts and data). An attacker needed to trick someone into using their malicious actor for this to work.
Solution / Mitigation
This issue is fixed in version 0.10.11.
Vulnerability Details
8.1(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
network
low
none
required
August 18, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-50143
First tracked: August 18, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 85%