Apify MCP Server Vulnerability Leaks API Tokens Via URL Concatenation

A critical vulnerability in Apify's MCP server allowed API tokens to be leaked through URL concatenation, as detailed in GitHub advisory GHSA-6gr2-qh89-hxwm. The flaw, fixed in version 0.10.11, occurred when a malicious Actor definition manipulated the URL to point to an attacker-controlled domain, inadvertently sending the user's API token with the connection. This vulnerability highlights a broader class of bugs related to unbound construction before credential attachment, where a lack of independent verification of the admitted URL can lead to token exfiltration. AI

IMPACT This vulnerability highlights potential security risks in how AI platforms handle API tokens and user data, emphasizing the need for robust security practices in interconnected systems.

RANK_REASON The item details a specific software vulnerability and its fix, which is a product-level security issue.

Read on dev.to — MCP tag →

• Apify
• application programming interface
• Bearer
• CVE-2026-50143
• CVE-2026-76404
• GHSA-6gr2-qh89-hxwm
• GitHub
• LangBot
• MCP
• Node.js
• Splunk
• Web Hypertext Application Technology Working Group

• product
• safety

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →