Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
Date: 2026-05
Affected: npm/@apify/actors-mcp-server
Attack vector: prompt-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-46341
CWE: CWE-183
CWE-20
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

### Summary The `fetch-apify-docs` tool validates URLs against a domain allowlist using `String.startsWith()` instead of proper URL hostname comparison. This allows bypass via attacker-controlled subdomains (e.g., `https://docs.apify.com.evil.com/`), enabling the tool to fetch and return arbitrary web content to the LLM. ### Details #### Vulnerable component `src/tools/common/fetch_apify_docs.ts`, line 51: ```typescript const isAllowedDomain = ALLOWED_DOC_DOMAINS.some((domain) => url.startsWith(domain)); ``` `src/const.ts`, lines 167-170: ```typescript export const ALLOWED_DOC_DOMAINS = [ 'https://docs.apify.com', 'https://crawlee.dev', ] as const; ``` #### How the bypass works `String.startsWith('https://docs.apify.com')` matches any string beginning with that prefix, including: - `https://docs.apify.com.evil.com/payload` - attacker-controlled subdomain - `https://docs.apify.com@evil.com/payload` - userinfo component in URL (browser behavior varies, but `fetch()` in Node.js may follow this) - `https://docs.apify.com.evil.com:8080/path` - custom port on attacker domain All of these pass the `startsWith` check because they begin with the exact string `https://docs.apify.com`. #### The fetched content is returned to the LLM After the allowlist check passes, the tool fetches the URL and returns the full page content as markdown (`fetch_apify_docs.ts:69-103`): ```typescript const response = await fetch(url); // ... const html = await response.text(); markdown


Mitigations:

Architectural layers (MAESTRO):