A critical Server-Side Request Forgery vulnerability in the Apify actors-mcp-server allows unauthenticated attackers to access internal network resources and sensitive cloud instance credentials.

The vulnerability exists in the get-html-skeleton tool, which performs insufficient validation on user-supplied URLs. An unauthenticated attacker can supply URLs that resolve to internal hostnames or private IP ranges, including cloud provider metadata endpoints, to retrieve sensitive information.

The ability to perform SSRF against cloud infrastructure poses a severe risk of credential theft, as attackers can exfiltrate instance metadata containing security tokens. With a CVSS score of 8.6, this high-severity flaw enables unauthorized access to internal systems that are not intended to be exposed to the public internet, potentially leading to a broader compromise of the cloud environment.

Immediate Action: Update the apify/actors-mcp-server package to version 0.9.12 or later, which completely removes the vulnerable get-html-skeleton tool.

Proactive Monitoring: Review access logs for the MCP server to identify requests containing internal IP addresses or unusual URL patterns targeting metadata services.

Compensating Controls: Deploy a Web Application Firewall (WAF) or egress filtering rules to restrict the server from initiating connections to private, loopback, or link-local address spaces.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for direct cloud credential exfiltration, organizations should prioritize the update to version 0.9.12 immediately. If an immediate update is not feasible, the affected tool must be disabled or access to the MCP server must be restricted to trusted internal clients only to prevent unauthorized exploitation.