Executive brief
auth-fetch-mcp is a tool used by AI agents to fetch web content and download media. A security flaw allows an attacker to bypass built-in protections and force the tool to access internal network services or local files that should be private. This could lead to the exposure of sensitive internal data or credentials if an AI agent is tricked into visiting a malicious link.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in auth-fetch-mcp due to an incomplete validation check in the isPrivateV6() function within src/security.ts. While the tool attempts to block private and loopback IP addresses, it fails to account for IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]) that are hex-normalized by the Node.js WHATWG URL parser into a format (e.g., [::ffff:7f00:1]) that bypasses the net.isIPv4() check. An attacker can exploit this by providing a specially crafted URL to the auth_fetch or download_media tools, enabling them to reach and read responses from internal services bound to the loopback interface. The vulnerability is addressed in version 3.0.2.
Affected products
- ymw0407 auth-fetch-mcp <= 3.0.1
Timeline
- 2026-05-27: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched: Fixed in version 3.0.2