CVE-2026-80347: mcp-fetch SSRF Vulnerability

CVE-2026-80347 Overview

CVE-2026-80347 is a Server-Side Request Forgery (SSRF) vulnerability in the mcp-fetch Model Context Protocol server. The isSafeUrl guard checks a fetch target without stripping the brackets surrounding an IPv6 literal. Because net.isIP returns zero for a bracketed value, the private-address branch is skipped and the guard falls back to name resolution. The HTTP client later strips the brackets and connects to the intended internal target. Attackers who influence the tool argument passed to the model can reach loopback, private-network, and cloud metadata endpoints, then read the responses back into the model context.

Critical Impact
Attackers can bypass the SSRF guard using bracketed IPv6 literals or IPv4-mapped IPv6 addresses to reach internal services and cloud metadata endpoints.

Affected Products

@kazuph/mcp-fetch npm package through version 1.6.3
Model Context Protocol integrations using mcp-fetch as a tool
LLM agents exposing mcp-fetch to untrusted prompts or data

Discovery Timeline

2026-08-26 - CVE-2026-80347 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80347

Vulnerability Analysis

The flaw resides in the isSafeUrl function of mcp-fetch. The function reads hostname from the parsed URL object, which for a literal such as http://[::1]/ returns the bracketed string [::1]. That bracketed string is then passed to net.isIP, which returns zero because the value is not a valid textual IP address. The zero return causes the code to skip the branch that enforces loopback and private-address checks.

The guard then falls back to DNS resolution. Because [::1] is not a resolvable hostname, no addresses are returned and the URL is reported as safe. The underlying HTTP client subsequently strips the brackets and connects to the literal IPv6 address. The vulnerability is classified as SSRF under [CWE-918].

Root Cause

The root cause is inconsistent parsing between the SSRF validator and the HTTP client. The validator treats the bracketed hostname as an opaque string, while the client interprets it as an IPv6 literal. A secondary defect is that isPrivateIPv6 has no case for the ::ffff: IPv4-mapped prefix. An IPv4-mapped literal such as [::ffff:169.254.169.254] bypasses the guard even if bracket stripping is added.

Attack Vector

The fetch target is supplied as a tool argument through the Model Context Protocol interface. An attacker who can influence prompts, tool inputs, or retrieved content processed by the model can request URLs such as http://[::1]/, http://[::ffff:127.0.0.1]/, or http://[::ffff:169.254.169.254]/latest/meta-data/. The response body is returned into the model context, exposing internal APIs, admin panels, and cloud instance metadata. See the VulnCheck Advisory for MCP-Fetch for exploitation details.

See the GitHub Issue #16 and mcp-fetch source repository for the affected code path.

Detection Methods for CVE-2026-80347

Indicators of Compromise

Outbound requests from the mcp-fetch process to loopback addresses, 169.254.169.254, or RFC1918 ranges
Fetch arguments containing bracketed IPv6 literals such as [::1], [::ffff:...], or [fc00::/7] ranges
Model responses that echo internal HTTP headers, metadata JSON, or private hostnames

Detection Strategies

Instrument the mcp-fetch server with request logging that captures the raw URL before and after guard evaluation
Alert on any successful fetch where the resolved destination is loopback, link-local, or private
Inspect MCP tool-call transcripts for URLs matching an IPv6 bracket regex followed by internal address patterns

Monitoring Recommendations

Route outbound traffic from MCP servers through an egress proxy that enforces allowlists at the network layer
Monitor cloud metadata service access from workloads hosting LLM tooling and treat unexpected hits as high-severity events
Correlate prompt content and tool arguments with resulting HTTP destinations to identify prompt-injection-driven SSRF

How to Mitigate CVE-2026-80347

Immediate Actions Required

Upgrade @kazuph/mcp-fetch to a fixed release once available and pin the version in package.json
Restrict the MCP server's network egress to an explicit allowlist of external hosts
Block access to 169.254.169.254 and other cloud metadata endpoints using IMDSv2 enforcement or host firewall rules
Treat any tool argument sourced from untrusted content as attacker-controlled and log it for review

Patch Information

A fix must strip brackets before calling net.isIP, reject bracketed hostnames that are not valid IPv6 literals after normalization, and add explicit handling for IPv4-mapped IPv6 addresses (::ffff:0:0/96). Track remediation in GitHub Issue #16 and the NPM Package Details page for release status.

Workarounds

Disable the mcp-fetch tool for agents exposed to untrusted input until a patched release is deployed
Deploy the MCP server behind an HTTP forward proxy that rejects private, loopback, link-local, and IPv4-mapped destinations
Run the server in a network namespace with no route to internal subnets or the cloud metadata address

bash

# Example iptables egress restriction for the mcp-fetch host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
ip6tables -A OUTPUT -d ::1/128 -j REJECT
ip6tables -A OUTPUT -d fc00::/7 -j REJECT
ip6tables -A OUTPUT -d fe80::/10 -j REJECT
ip6tables -A OUTPUT -d ::ffff:0:0/96 -j REJECT