CVE-2026-81848: Scrapling-Fetch-MCP SSRF Vulnerability

CVE-2026-81848 Overview

CVE-2026-81848 is a Server-Side Request Forgery (SSRF) vulnerability in the cyberchitta scrapling-fetch-mcp project through version 0.2.2. The flaw resides in the s_fetch_page and s_fetch_pattern functions within src/scrapling_fetch_mcp/_fetcher.py. The functions accept arbitrary URL schemes without validation, allowing an attacker to coerce the server into issuing requests to unintended destinations. The issue is fixed in version 0.2.3 via commit 9f6f34e92c55c3d95566ad9c62aca7327d24533a. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
A remote authenticated attacker can trigger the MCP server to fetch attacker-chosen URLs, including non-HTTP schemes, exposing internal services and local resources.

Affected Products

cyberchitta/scrapling-fetch-mcp versions up to and including 0.2.2
MCP (Model Context Protocol) servers embedding the vulnerable _fetcher.py module
AI assistant integrations that expose the s_fetch_page or s_fetch_pattern tools

Discovery Timeline

2026-08-28 - CVE-2026-81848 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-81848

Vulnerability Analysis

The scrapling-fetch-mcp project provides a Model Context Protocol (MCP) server that fetches HTML and markdown content from bot-protected websites for AI assistants. The fetch functions s_fetch_page and s_fetch_pattern accept a URL parameter and pass it directly to the underlying browser automation layer. No scheme validation is performed before the fetch is executed.

Because the caller controls the full URL string, an attacker can supply schemes such as file://, gopher://, or ftp://, or point to internal network endpoints like http://169.254.169.254/ (cloud metadata) or http://127.0.0.1/. The server then dispatches the request from its own network position, returning content that would otherwise be inaccessible to the caller.

Root Cause

The root cause is missing input validation on the URL scheme before dispatch. The fetch pipeline treated any string as a valid target and delegated it to browse_url. This aligns with the CWE-918 pattern: user-supplied URLs used in server-side requests without an allow-list of safe schemes or destinations.

Attack Vector

Exploitation requires network access to the MCP server and the ability to invoke the fetch tool, which is typically exposed through an AI assistant session. User interaction is generally involved since the AI assistant relays the tool call. Successful exploitation enables enumeration of internal services, retrieval of cloud instance metadata, and reading of local files when non-HTTP schemes are permitted by the underlying browser.

python

# Security patch in src/scrapling_fetch_mcp/_fetcher.py
# fix: restrict fetch URLs to http/https schemes
 from re import compile
 from re import error as re_error
 from typing import Optional
+from urllib.parse import urlparse

 from bs4 import BeautifulSoup

 from scrapling_fetch_mcp._markdownify import _CustomMarkdownify
 from scrapling_fetch_mcp._scrapling import browse_url


+def _require_web_url(url: str) -> str:
+    scheme = urlparse(url).scheme.lower()
+    if scheme not in ("http", "https"):
+        raise ValueError(
+            f"unsupported URL scheme '{scheme}': only http/https are allowed"
+        )
+    return url
+
+
 def _html_to_markdown(html: str) -> str:
     soup = BeautifulSoup(html, "lxml")
     for script in soup(["script", "style"]):

Source: GitHub Commit 9f6f34e. The patch introduces a _require_web_url helper that parses the URL and rejects any scheme other than http or https.

Detection Methods for CVE-2026-81848

Indicators of Compromise

Outbound requests from the MCP server host to internal IP ranges such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or link-local 169.254.169.254.
MCP tool invocations containing URLs with non-HTTP schemes such as file://, gopher://, ftp://, or dict://.
Anomalous fetch volumes or destinations in scrapling-fetch-mcp process logs.

Detection Strategies

Log every URL argument passed to s_fetch_page and s_fetch_pattern and alert on non-http(s) schemes.
Correlate MCP server egress traffic with expected external targets and flag requests to RFC1918 or metadata addresses.
Inspect AI assistant transcripts for tool calls that reference internal hostnames or cloud metadata endpoints.

Monitoring Recommendations

Route MCP server egress through a filtering proxy that enforces destination allow-lists.
Enable process-level network telemetry on hosts running scrapling-fetch-mcp and forward it to a centralized analytics store.
Track the installed version of scrapling-fetch-mcp across environments to confirm all instances are at 0.2.3 or later.

How to Mitigate CVE-2026-81848

Immediate Actions Required

Upgrade scrapling-fetch-mcp to version 0.2.3 or later, which includes commit 9f6f34e92c55c3d95566ad9c62aca7327d24533a.
Audit exposure of the MCP server to untrusted callers and restrict access to authenticated internal users.
Review historical MCP fetch logs for prior invocations targeting internal or non-web URL schemes.

Patch Information

The fix is available in scrapling-fetch-mcp version 0.2.3. The patch adds a _require_web_url function that validates the URL scheme via urllib.parse.urlparse and raises ValueError for anything other than http or https. See the GitHub commit 9f6f34e and GitHub Issue #6 for details.

Workarounds

Deploy the MCP server on a network segment with strict egress filtering that blocks RFC1918, loopback, and cloud metadata destinations.
Wrap fetch tool calls in an outer proxy that enforces http/https scheme validation before invoking the vulnerable code path.
Disable the s_fetch_page and s_fetch_pattern tools in the MCP configuration until the upgrade to 0.2.3 is complete.

bash

# Upgrade to the patched version
pip install --upgrade 'scrapling-fetch-mcp>=0.2.3'

# Verify the installed version
python -c "import importlib.metadata; print(importlib.metadata.version('scrapling-fetch-mcp'))"