Description

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-13T15:19:41.743Z",
  "pubdate": "2026-08-13T15:19:41.743Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in auth-fetch-mcp version 3.0.1 and prior, affecting the Server-Side Request Forgery protection mechanism implemented in the src/security.ts file. The flaw stems from insufficient validation of IPv4-mapped IPv6 addresses within the isPrivateV6() function, which fails to properly identify hex-normalized representations of loopback and private IP addresses.\nBy supplying a crafted URL containing a hex-normalized IPv4-mapped IPv6 address, an attacker can bypass the assertSafeUrl() security control. This allows malicious payloads to trick the AI assistant and its underlying MCP server into routing outbound HTTP requests to internal loopback services and private network resources that should otherwise be restricted.\nThe vulnerability requires no prior authentication, special environment variables, or elevated privileges, making it exploitable under default configuration settings. Successful exploitation enables unauthorized interactions with internal services running on local network loopback interfaces, potentially exposing sensitive local data or triggering unintended actions on internal infrastructure.",
  "technicalDetails": "The root cause of the vulnerability resides in the src/security.ts module of auth-fetch-mcp, specifically within the URL validation logic designed to mitigate Server-Side Request Forgery via the assertSafeUrl() function. The mechanism attempts to block outbound requests destined for private and loopback IP addresses by parsing target destinations and evaluating them against internal classification checks, including the isPrivateV6() function.\nThe vulnerability is triggered when an attacker supplies a specialized URL utilizing an IPv4-mapped IPv6 format, such as http://[::ffff:127.0.0.1]:PORT/. Upon processing, the Node.js WHATWG URL parser silently normalizes the host component into an alternative hexadecimal representation, specifically transforming it to [::ffff:7f00:1]. Following this parser normalization, the internal validation routine evaluates the resulting address using net.isIPv4('7f00:1'). Because this check evaluates to false, the security control incorrectly determines that the IP address is not a private or loopback address.\nAs a direct result of this validation failure, the assertSafeUrl() function permits the execution flow to bypass the security check. The unmitigated URL is subsequently passed down to the underlying HTTP client or browser automation component. The MCP tool then initiates outbound network connections to the targeted loopback services, successfully circumventing the intended security boundaries of the server.\nThe affected component is auth-fetch-mcp version 3.0.1 and earlier, specifically the src/security.ts file containing the IP validation and parsing routines. The attack vector requires network exposure to the MCP server and relies entirely on client-supplied URLs processed by AI assistants utilizing the vulnerable tool. No special privileges or authentication mechanisms are required to mount the attack, as it is exploitable under default deployment configurations."
}