Vulnerability Description
APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the `webhook_events` PostgreSQL table without any signature check or authentication requirement. The root cause is that `createWebhookRouter` is called at `server.ts:188` without a `validators` map, so `receivers.ts:80`'s optional-chaining guard evaluates to `undefined` and the signature-validation block (`receiver.ts:81–95`) is unconditionally skipped. Any unauthenticated network client that knows a valid server slug can inject arbitrary payloads, which are subsequently served as trusted resource state to legitimate MCP clients. Commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 patches the issue.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Work90210/APIFold/commit/7f19b52280f414f57af2b79a95333d1c8fbe
- https://github.com/Work90210/APIFold/pull/235
- https://github.com/Work90210/APIFold/security/advisories/GHSA-x82h-9r8v-m672
FAQ
What is CVE-2026-47769?
CVE-2026-47769 is a vulnerability with a CVSS score of 5.3 (MEDIUM). APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSl...
How severe is CVE-2026-47769?
CVE-2026-47769 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-47769?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.