CVE-2026-50143 Actor MCP path authority injection leaks Apify token
A malicious Actor definition can redirect MCP client connections to an attacker-controlled host, leaking the victim's Apify API token and granting unauthorized access to data and compute resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50143?
CVE-2026-50143 is a high-severity server-side request forgery vulnerability in apify-mcp-server, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.
Weakness: CWE-918
Which versions are affected by CVE-2026-50143?
2 open source packages ship an affected version, including @apify/actors-mcp-server.
| Package | Affected | Fixed in |
|---|---|---|
@apify/actors-mcp-server npm | All versions | 0.10.11 |
@apify/actors-mcp-server npm | All versions | 0.10.11 |
How do I fix CVE-2026-50143?
Upgrade @apify/actors-mcp-server to 0.10.11 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-50143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50143 exists.
Sources
Also known as GHSA-6gr2-qh89-hxwm.