CVE-2026-73082CWE-200CWE-918information-disclosuressrf

CVE-2026-73082

published August 11, 2026

CVSS
5.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the POST /api/v1/projects/:projectId/mcp-server/validate-agent-mcp-tool endpoint makes an outbound HTTP or SSE request to a user-supplied serverUrl without URL validation or SSRF protection. An authenticated user can cause the Activepieces server to connect to internal services, cloud metadata endpoints, or arbitrary external hosts and probe network reachability from the Activepieces host. This issue is fixed in version 0.82.0.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-11T21:19Z
References (4)
https://github.com/activepieces/activepieces/commit/d385079cf4a9f35ddf61ba68ecda6ac8d64cf9e1 · [email protected]https://github.com/activepieces/activepieces/pull/12721 · [email protected]https://github.com/activepieces/activepieces/releases/tag/0.82.0 · [email protected]https://github.com/activepieces/activepieces/security/advisories/GHSA-7qx9-q4xx-rh59 · [email protected]
EPSS history
Timeline
  • 11 AUG 16:30Z
    Activepieces: Server-side request forgery in MCP tool validation endpoint
    cvelistv5