What happened
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1's assertSafeUrl() SSRF protection fails to detect IPv4-mapped IPv6 addresses in its isPrivateV6() check (CVE-2026-49857, CVSS 7.4, High), allowing requests to private/loopback addresses to bypass the blocklist.
Why it matters
This MCP tool is designed to fetch authenticated content on behalf of an LLM agent; an SSRF bypass lets a prompt-injected or malicious request reach internal network services (including cloud metadata endpoints) using an AI agent's fetch credentials.
Attack vector
Attacker (or prompt-injected agent) supplies an IPv4-mapped IPv6 address as a fetch target, bypassing the private/loopback address blocklist to reach internal services
Affected systems
auth-fetch-mcp 3.0.1
Mitigation
Upgrade to a patched version once available; interim mitigation is to enforce network-level egress restrictions on the MCP server host