Description

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T18:17:53.227Z",
  "pubdate": "2026-08-18T18:17:53.227Z",
  "executiveSummary": "An origin validation vulnerability exists in the Apify MCP server prior to version 0.10.11, specifically within the getActorMCPServerURL function located in src/mcp/actors.ts. The vulnerability involves improper URL concatenation of the trusted Actor standby URL and an attacker-controlled webServerMcpPath derived from an Actor definition. By leveraging a userinfo-style authority value, a malicious Actor publisher can successfully redirect the connectMCPClient mechanism to an arbitrary third-party host.\nThe primary impact of this flaw is the unintended exposure of sensitive authentication credentials. When affected tool-loading paths—namely call-actor, fetch-actor-details, and actor-mcp—pass the maliciously constructed URL to transports in src/mcp/client.ts, the victim client automatically attaches their Apify Authorization bearer token to the outgoing request. This leaks the API token to the adversary.\nCompromise of the Apify API token grants the attacker unauthorized access to the victim's account resources, including stored data, managed Actors, and billable compute infrastructure. Successful exploitation requires user interaction, specifically that a victim must invoke or inspect the attacker-controlled Actor. Affected systems comprise deployments running versions of the Apify MCP server prior to 0.10.11.",
  "technicalDetails": "The vulnerability stems from insecure URL manipulation and lack of proper origin verification in the getActorMCPServerURL function within src/mcp/actors.ts. The underlying root cause is the direct concatenation of a trusted Actor standby URL with an attacker-controlled webServerMcpPath parameter supplied via a malicious Actor definition.\nAttackers can exploit this improper parsing by supplying a crafted webServerMcpPath containing a userinfo-style authority component (such as an embedded username, password, or '@' character). When the URL parser and concatenation routines process this input, the resulting origin is modified, causing the client connection routine (connectMCPClient) to direct traffic to an attacker-controlled third-party host instead of the intended trusted infrastructure.\nThe attack flow proceeds through specific tool-loading mechanisms in the application. When a victim interacts with the system via the call-actor, fetch-actor-details, or actor-mcp tool-loading paths, the application initializes a transport layer defined in src/mcp/client.ts. This transport automatically appends the victim's secret Apify Authorization bearer token to HTTP requests destined for the target URL.\nBecause the URL has been successfully redirected to the adversary's external endpoint via the userinfo manipulation, the victim's transport layer unwittingly transmits the Authorization bearer token directly to the attacker's server. No specialized privileges are required on the victim's end other than normal user interaction, requiring the victim to invoke or inspect the malicious Actor published on the Apify Store.\nThe post-exploitation impact is severe. Acquisition of the victim's Apify API token allows the malicious Actor publisher to impersonate the victim across the Apify platform, granting unauthorized access to private Actors, retrieving confidential stored data, and consuming billable compute resources for illicit activities."
}