Executive brief
auth-fetch-mcp is an MCP (Model Context Protocol) server tool that allows fetching web pages and downloading media via authenticated browser sessions. The vulnerability allows an attacker (via prompt injection or a malicious MCP client) to force the server to make HTTP requests to internal services (cloud metadata endpoints, loopback services, private networks) and exfiltrate the responses to disk or back to the attacker. This could expose cloud credentials, database content, or other sensitive internal data.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) affecting two tools: auth_fetch and download_media. Both tools accept arbitrary URLs without validation and forward requests through the MCP server's network context (Playwright browser). The auth_fetch tool navigates to the provided URL and returns page content; download_media fetches URLs and persists responses to a user-controlled output directory. An attacker can specify internal URLs (127.0.0.1, 169.254.169.254, 192.168.x.x, 10.x.x.x) to reach cloud metadata endpoints, loopback services, or internal networks. The download_media variant compounds the risk by writing responses to filesystem locations the attacker can specify, enabling exfiltration to shared directories. The attack requires MCP client control (e.g., via prompt injection in LLM context), but no authentication or user interaction.
Affected products
- ymw0407 auth-fetch-mcp <= 3.0.0
Timeline
- 2026-05-19: disclosed