EUVD-2026-60234
GHSA-c33j-cj33-6649
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changes to cloud metadata service yielding IAM credentials justifies S:C and C:H; PR:L reflects required MCP tool authorization; no integrity or availability impact applies.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in fetcher-mcp versions 0.3.0 through 0.3.9 allows low-privileged remote attackers to redirect the fetch_url and fetch_urls functions toward internal network resources, including cloud instance metadata endpoints such as the AWS IMDS path /latest/meta-data/iam/security-credentials/. When deployed on cloud infrastructure, this can result in exposure of IAM credentials tied to the host instance role, representing a scope-changing impact beyond what the CVSS 4.0 Medium rating conveys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have authorization to invoke the fetch_url or fetch_urls MCP tool, which corresponds to PR:L in the CVSS vector - some level of authenticated access to the MCP server session is required (e.g., an authorized AI assistant user). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.3 (Medium) reflects low privileges and limited direct system impact (VC:L/VI:L/VA:L/SC:N), but this framing materially understates real-world risk in the primary deployment scenario - cloud-hosted AI tooling on EC2 or comparable compute. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege access to an AI assistant session backed by fetcher-mcp invokes the fetch_url tool with the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole. The MCP server, lacking URL validation, forwards the request to the EC2 metadata service on the host and returns the JSON response containing AccessKeyId, SecretAccessKey, and SessionToken. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the GitHub issue disclosure at https://github.com/jae-jae/fetcher-mcp/issues/37. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today