Apify MCP Server Authority Confusion Leads to Bearer Token Exfiltration

Technical Analysis

The function getActorMCPServerURL concatenates a trusted standby URL with an attacker-supplied 'webServerMcpPath' field from an Actor definition without validating the resulting origin, permitting userinfo-style authority manipulation (e.g., https://trusted-host@attacker.com/) to redirect the effective host. This malicious URL flows into connectMCPClient and is used by call-actor, fetch-actor-details, and actor-mcp tool-loading code paths in src/mcp/client.ts, which attach the victim's Authorization bearer token to outbound transport requests regardless of destination. Because the MCP client trusts Actor-supplied metadata as part of a legitimate connection URL rather than untrusted input, the boundary between trusted infrastructure and attacker-controlled third-party Actors collapses, letting a published malicious Actor silently harvest live API tokens. The attacker gains the victim's Apify API token, enabling access to their Actors, stored datasets, and billable compute — a significant lateral escalation from a single tool invocation.

Affected Systems

Apify MCP server; protocols: MCP

Detection Signatures

• Outbound MCP connections where the resolved host does not match the expected Actor standby domain
• URLs containing userinfo-style authority segments (e.g., '@' before the actual host) in webServerMcpPath or actor definition fields
• Authorization headers observed on requests to unexpected/non-apify.com destinations
• Actor definitions with anomalous or obfuscated webServerMcpPath values
• Unexpected outbound traffic correlated with call-actor, fetch-actor-details, or actor-mcp tool invocations

Remediation Steps

1. 1

   Upgrade Apify MCP server

   Update to version 0.10.11 or later, which fixes the URL origin validation issue in getActorMCPServerURL.

2. 2

   Validate and pin destination origins

   Enforce strict allow-listing of MCP transport destinations to trusted Apify standby domains before attaching any Authorization bearer tokens.

3. 3

   Scope and rotate API tokens

   Use least-privilege, short-lived Apify API tokens for MCP clients and rotate any tokens that may have been used with untrusted or third-party Actors.

4. 4

   Audit Actor definitions before use

   Inspect webServerMcpPath and other Actor-supplied URL fields for authority manipulation patterns prior to invoking untrusted Actors.

5. 5

   Monitor outbound MCP traffic

   Log and alert on MCP client connections whose resolved host diverges from the expected trusted Actor domain.