mcp-fetch CVE-2026-80347

Exploitation requires the ability to influence the URL argument passed to the mcp-fetch tool, which in practice means injecting content - typically via prompt injection in externally fetched text, user-supplied prompts, or adversarial documents - that directs the model to invoke the fetch tool with a crafted URL. The mcp-fetch server must be network-reachable to the internal targets (e.g., the instance must be running on a cloud VM for the 169.254.169.254 metadata endpoint to be accessible). No authentication to mcp-fetch itself is required per the CVSS 4.0 PR:N metric. Exploitation is strictly a confidentiality impact - reading internal service responses; no write or availability impact is described. Exploitation is limited to environments where mcp-fetch actively processes untrusted or attacker-influenced content; air-gapped or fully trusted-input deployments are not practically exploitable.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H scoring 8.7 reflects the reality that no prerequisites are required beyond the ability to inject a URL argument into the model's tool call - consistent with typical prompt-injection workflows against AI agents. Real-world exploitability is strongly context-dependent: deployments where mcp-fetch processes untrusted user input or externally fetched content (the classic prompt-injection vector) on a cloud-hosted instance face meaningful exposure to metadata endpoint exfiltration (e.g., AWS IMDSv1 at 169.254.169.254), which can yield instance credentials. In tightly controlled deployments where tool arguments are fully trusted, risk is substantially lower. The absence of a CISA KEV listing and no confirmed active exploitation reduce urgency. EPSS data is not present in the available intelligence. The product's niche deployment footprint (MCP AI-agent tooling) meaningfully limits the aggregate exposed population compared to mainstream infrastructure software, despite the technical severity being high. The dual-flaw nature - bracket bypass plus IPv4-mapped prefix blind spot - suggests the SSRF guard was not subjected to IPv6 edge-case testing, and any partial fix addressing only one path would leave the other open.

An attacker embeds a prompt-injection instruction inside a web page or document that an AI agent using mcp-fetch is directed to fetch. The injected instruction directs the model to call the fetch tool with the URL http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/ - a cloud metadata endpoint expressed in IPv4-mapped IPv6 form with brackets. The SSRF guard skips the private-address check due to the bracket parsing flaw, reports the target safe, and the HTTP client connects to the metadata service, returning IAM credentials into the model's context. A public issue report at https://github.com/kazuph/mcp-fetch/issues/16 documents the bypass logic.