Apify MCP Server Domain Allowlist Bypass via Prefix-Matching Flaw
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 6.1
The Apify MCP server's documentation-fetching tool checked allowed domains using a naive string prefix match instead of proper URL hostname parsing, letting an attacker craft URLs like docs.apify.com.evil.com to bypass the allowlist. This allows arbitrary attacker-controlled content to be fetched and returned to the LLM agent, which could then be used to inject malicious instructions or exfiltrate context. The issue was fixed in version 0.9.21.
Technical Analysis
The fetch-apify-docs tool validated target URLs against ALLOWED_DOC_DOMAINS using JavaScript's String.startsWith(), a substring check that does not correctly parse the URL's hostname. This allows attacker-controlled hosts (e.g., docs.apify.com.evil.com or docs.apify.com@evil.com, exploiting userinfo/subdomain confusion) to satisfy the check while resolving to a domain entirely under attacker control. The entry point is any input path that lets a user or upstream agent supply a URL to the tool, and the impact is that the MCP server fetches attacker-hosted content and returns it as trusted documentation into the LLM's context window. This crosses the tool-to-model boundary, enabling downstream prompt injection, data poisoning of agent context, or SSRF-style probing of internal/external resources, since the agent will treat the fetched content as legitimate Apify documentation.
Affected Systems
Apify MCP server; protocols: MCP
Detection Signatures
- URLs matching pattern of allowlisted domain followed by additional characters, e.g. docs.apify.com.*, docs.apify.com@*
- Outbound fetch requests from MCP server to unexpected/non-Apify-owned IP ranges
- Tool logs showing fetch-apify-docs invoked with URLs containing '@' or extra subdomain labels appended to expected domain
- Unexpected content-length or content-type mismatches in fetched documentation responses
Remediation Steps
- 1
Upgrade Apify MCP server
Update to version 0.9.21 or later where the domain validation logic is fixed.
- 2
Enforce proper hostname parsing
Replace substring/prefix checks with URL parsing (e.g., new URL(input).hostname) and exact-match or suffix-with-dot-boundary comparison against the allowlist.
- 3
Sanitize and validate userinfo/authority components
Reject URLs containing '@' in the authority section or other userinfo tricks before hostname extraction.
- 4
Sandbox fetched content
Treat all fetched documentation as untrusted external input; do not allow it to alter tool behavior or agent instructions without further validation.
- 5
Monitor egress traffic
Log and alert on MCP server outbound requests to domains outside a strict, exact-match allowlist.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.