Description
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jae-jae | fetcher-mcp | 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9 | — |
References
- VDB-391221 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery vdb-entry technical-description
- VDB-391221 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-74858 | CVE Analysis and Report third-party-advisory
- Submit #876015 | jae-jae fetcher-mcp 0.3.9 non-blind SSRF third-party-advisory
- https://github.com/jae-jae/fetcher-mcp/issues/37 broken-link issue-tracking
- https://github.com/jae-jae/fetcher-mcp/ product