CVE record published for an Apify MCP server flaw that could redirect a client's bearer token to a third-party host

A CVE record for the Apify MCP server was published on 2026-08-18. CVE-2026-50143 describes an authority-injection flaw in how the server built the URL for an Actor's own MCP endpoint, and rates it 8.1 high on CVSS 3.1.

Apify's platform hosts Actors, the scrapers and automation programs its users publish and run. The MCP server can load an Actor's own MCP tools, and to do that getActorMCPServerURL in src/mcp/actors.ts joined the trusted standby URL for that Actor with a webServerMcpPath value taken from the Actor's definition. The resulting origin was not checked. A publisher who set that path to a userinfo-style authority value could therefore make the URL resolve to a host they controlled, while it still read as an Apify address.

The consequence is credential loss rather than a redirect alone. The call-actor, fetch-actor-details and actor-mcp tool-loading paths hand the URL to transports in src/mcp/client.ts that attach the victim's Authorization bearer token, so the attacker's host receives an Apify API token with access to that user's Actors, stored data and billable compute. Exploitation requires the victim to invoke or inspect the attacker's Actor.

Apify published its own advisory, GHSA-6gr2-qh89-hxwm, on 2026-05-28 and released the fix in @apify/actors-mcp-server 0.10.11 the same day. The CVE record trails both by close to three months.