What happened
VulDB/NVD published an SSRF (CWE-918) in the official mcp-server-fetch and mcp-server-everything reference servers affecting versions up to 2026.6.4. The exploit has been publicly disclosed and the fixing pull request was still awaiting merge at publication (2026-10-02).
Why it matters
This is the official Anthropic-maintained MCP fetch reference implementation — the de-facto 'browse the web' tool that agents wire up by default. It is unauthenticated at the tool-call level and reachable by any LLM agent granted the tool, so a prompt-injected agent can pivot it into SSRF against internal/cloud-metadata infrastructure.
Attack vector
A crafted url/path argument to the Fetch Tool's fetch_url causes server-side request forgery; an agent steered via prompt injection (or a direct caller) can make the MCP server reach internal services, including cloud metadata endpoints.
Affected systems
modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4 (Fetch Tool, fetch_url function)
Mitigation
Watch the pending fix PR (https://github.com/modelcontextprotocol/servers/pull/4890); restrict the fetch server's egress, run it with least-privilege network access, and treat attacker-supplied URLs as untrusted.