Skip to content
OpenAdvisories

Package · npm

auth-fetch-mcp

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.4
    CVE-2026-49857

    auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

    auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV…

    ymw0407 auth-fetch-mcp auth-fetch-mcp npm
  • High 8.2
    GHSA-hv85-774v-26fg

    auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

    # SSRF + disk-exfil in `download_media` and `auth_fetch` tools — ymw0407/auth-fetch-mcp ## Severity The `download_media` and `auth_fetch` MCP tools accept arbitrary URLs and reach them as the MCP server process, with `download_media` additionally persisting t…

    auth-fetch-mcp npm