{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-50143",
    "name": "CVE-2026-50143",
    "vendor": "@apify/actors-mcp-server",
    "description": "A path injection flaw in the @apify/actors-mcp-server npm package lets a malicious Actor with a crafted webServerMcpPath redirect the MCP client to an attacker host, exfiltrating the victim's Apify API token through the authorization header. Rated CVSS 8.1; any MCP client wired to a compromised Apify Actor is affected.",
    "website": "https://advisories.gitlab.com/npm/@apify/actors-mcp-server/CVE-2026-50143/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "@apify/actors-mcp-server",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-01",
    "risk": {
      "score": 81,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-50143",
      "aliases": [
        "ti-045"
      ],
      "title": "CVE-2026-50143: Apify MCP Server Leaks API Tokens via Path Injection",
      "summary": "A path injection flaw in the @apify/actors-mcp-server npm package lets a malicious Actor with a crafted webServerMcpPath redirect the MCP client to an attacker host, exfiltrating the victim's Apify API token through the authorization header. Rated CVSS 8.1; any MCP client wired to a compromised Apify Actor is affected.",
      "severity": "high",
      "cvss": {
        "score": 8.1,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "@apify/actors-mcp-server",
        "vendor": null,
        "package": "@apify/actors-mcp-server",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<0.10.11",
          "fixed": "0.10.11"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-07-01",
      "modifiedAt": "2026-07-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://advisories.gitlab.com/npm/@apify/actors-mcp-server/CVE-2026-50143/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50143"
        }
      ],
      "mitigation": "Upgrade @apify/actors-mcp-server to 0.10.11 or later to stop Apify token exfiltration via crafted MCP paths.",
      "detectedByAnomity": true
    }
  }
}