Executive brief
mcp-fetch is a tool that fetches content from URLs on behalf of an AI model. It includes a security guard to block requests to internal services, loopback addresses, and cloud metadata endpoints. An attacker can bypass this guard by using IPv6 address formats with brackets (e.g., http://[::1]/) or IPv4-mapped IPv6 addresses (e.g., http://[::ffff:127.0.0.1]/), allowing the model to fetch and read sensitive internal content back into its context.
Technical details
The vulnerability is an SSRF (Server-Side Request Forgery) guard bypass in the isSafeUrl validation function. The root cause is that the function reads the hostname from a parsed URL without stripping IPv6 literal brackets before passing it to net.isIP(). For IPv6 addresses like http://[::1]/, the hostname is returned as "[::1]" (bracketed), and net.isIP("[::1]") returns 0, causing the IP validation branch to be skipped. The function then attempts DNS resolution on the bracketed string, which fails and returns no IPs, so the URL is incorrectly deemed safe. Additionally, isPrivateIPv6() lacks handling for IPv4-mapped IPv6 addresses (::ffff: prefix). An attacker who can control the fetch URL (via tool arguments influenced by prompt injection) can bypass the guard and reach loopback, link-local metadata endpoints, and private IPv4 addresses. No authentication is required; the attack vector is network-reachable via model-directed tool invocation. A patch should normalize hostnames by stripping IPv6 brackets before validation and add explicit ::ffff: handling.
Affected products
- kazuph mcp-fetch <=1.6.2
Timeline
- 2026-08-26: disclosed: CVE-2026-80347 published