Executive brief
Fetch MCP Server is a Node.js library that fetches and processes remote URLs via the Model Context Protocol. A server-side request forgery vulnerability allows attackers to bypass internal IP protection and access private network resources, including internal APIs, cloud metadata endpoints, and sensitive administrative interfaces that should be blocked.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Fetcher.ts _fetch() method due to incorrect parameter passing to the is_ip_private() validation function. The code passes the full URL string (e.g., "http://192.168.1.1:8080/api/data") instead of just the hostname, causing the private IP check to always return false and bypass all internal IP restrictions. The vulnerability affects mcp-fetch-server v1.0.2 and earlier. An unauthenticated attacker can craft a fetch request to any network-reachable MCP Server instance, allowing access to internal services, cloud metadata endpoints (AWS/GCP/Azure), and sensitive administrative panels. Patches are available; the fix requires extracting the hostname from the URL before validation.
Affected products
- mcp-fetch-server mcp-fetch-server 1.0.2 and earlier
Timeline
- 2025-12-10: disclosed
- 2025-12-09: advisory