CyberRota Analysis
AI-GeneratedThe vulnerability affects the F5 APIFold product, specifically in the `/webhooks/:serverSlug/:eventName` endpoint, which allows unauthenticated clients to submit arbitrary JSON payloads that are stored in Redis and a PostgreSQL database without any signature validation. This flaw can lead to the injection of malicious data, potentially compromising the integrity of the resource state served to legitimate clients. Organizations using affected versions of F5 APIFold should prioritize applying the patch from commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the `webhook_events` PostgreSQL table without any signature check or authentication requirement. The root cause is that `createWebhookRouter` is called at `server.ts:188` without a `validators` map, so `receivers.ts:80`'s optional-chaining guard evaluates to `undefined` and the signature-validation block (`receiver.ts:81–95`) is unconditionally skipped. Any unauthenticated network client that knows a valid server slug can inject arbitrary payloads, which are subsequently served as trusted resource state to legitimate MCP clients. Commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 patches the issue.