CVE-2026-49857
Received Received - Intake

SSRF Bypass via IPv4-Mapped IPv6 in auth-fetch-mcp

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-49857
EUVD
EUVD-2026-58054

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ymw0407 auth-fetch-mcp 3.0.1
ymw0407 auth-fetch-mcp to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in auth-fetch-mcp versions 3.0.1 and earlier. It allows bypassing SSRF protections by exploiting IPv4-mapped IPv6 loopback addresses. When an attacker provides a URL like http://[::ffff:127.0.0.1]:PORT/, the Node.js URL parser normalizes it to http://[::ffff:7f00:1]:PORT/. The SSRF check fails because the function checks the suffix 7f00:1 with net.isIPv4(), which returns false, allowing the request to reach internal loopback services.

Detection Guidance

To detect this vulnerability, check if you are running auth-fetch-mcp version 3.0.1 or earlier. Use commands like 'npm list auth-fetch-mcp' or inspect package.json for version details. Test if SSRF protection is bypassed by attempting requests to loopback addresses in IPv4-mapped IPv6 format, such as 'http://[::ffff:127.0.0.1]:PORT/'.

Impact Analysis

An attacker could exploit this to access internal HTTP services on your machine, such as local development servers or admin panels. This could lead to unauthorized data access, service disruption, or further attacks against internal systems. The vulnerability is exploitable without special privileges or environment variables.

Mitigation Strategies

Immediately upgrade to version 3.0.1 or later of auth-fetch-mcp. If upgrading is not possible, restrict network access to prevent outbound requests to loopback or private addresses. Review and enable environment variables AUTH_FETCH_ALLOW_PRIVATE or AUTH_FETCH_ALLOW_HOSTS only if necessary for trusted local development.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49857. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart