CVE-2026-104120 in mcp-server-fetch
Summary
by MITRE • 10/02/2026
A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the file mcp_server_fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The modelcontextprotocol ecosystem, specifically within the mcp-server-fetch and mcp-server-everything components prior to version 2026.6.4, contains a critical server-side request forgery vulnerability rooted in the fetch_url function located in the mcp_server_fetch/server.py file. This flaw arises from insufficient validation of user-supplied input passed via the url or path arguments. When an attacker provides a maliciously crafted URL, the application fails to properly restrict the destination host or protocol scheme, allowing it to initiate HTTP requests on behalf of the server to arbitrary internal or external resources. This lack of strict allowlisting for target endpoints creates a direct pathway for exploitation, as the server effectively becomes a proxy that can be manipulated by remote actors to access services that are otherwise inaccessible from the public internet.
The operational impact of this vulnerability is significant due to its potential for data exfiltration and internal network reconnaissance. By leveraging Server-Side Request Forgery, an attacker can target sensitive internal APIs, cloud metadata endpoints such as those found in AWS or Azure environments, or local database interfaces that are not exposed directly to the outside world but are accessible from within the server's network context. This capability allows for the extraction of confidential data stored on internal services and facilitates further lateral movement within a compromised infrastructure. The vulnerability is classified under CWE-918, which addresses Server-Side Request Forgery (SSRF), highlighting the failure to validate user-controlled input before processing it in server-side requests.
From an offensive security perspective, this flaw aligns with ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer variants that utilize SSRF for network discovery and credential theft. The exploit has been publicly disclosed, meaning that automated scanning tools and malicious actors can readily identify and leverage this weakness in unpatched deployments. Since the attack vector is remote, no authentication or physical proximity to the target system is required, significantly lowering the barrier to entry for attackers seeking to compromise systems running these specific versions of the model context protocol servers.
Mitigation strategies must focus on immediate remediation through software updates and architectural hardening. The primary solution is to upgrade mcp-server-fetch and mcp-server-everything to version 2026.6.4 or later, where the pull request addressing this issue has been integrated. Until such an update is available, administrators should implement network-level controls such as firewall rules that restrict outbound HTTP traffic from the server to only known trusted domains. Additionally, input validation mechanisms should be enforced at the application layer to ensure that all URL parameters are checked against a strict allowlist of permitted hosts and protocols, rejecting any requests targeting private IP ranges or non-HTTP schemes unless explicitly required for legitimate operations.