CVE-2026-49857 is a high-severity server-side request forgery (SSRF) vulnerability in auth-fetch-mcp (npm), affecting versions <= 3.0.1. It is fixed in 3.0.2.
SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of 7.4 (High). Details The vulnerable function is isPrivateV6() in src/security.ts, called from assertSafeUrl() which gates every outbound request made by the authfetch and downloadmedia MCP tools. Root cause, src/security.ts:46-50: The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After new URL(...).hostname | |---|---| | ::ffff:127.0.0.1 | ::ffff:7f00:1 | | ::ffff:192.168.1.1 | ::ffff:c0a8:101 | After normalization, the suffix after ::ffff: is no longer a dotted-decimal IPv4 string, so net.isIPv4() returns false. The guard falls through and isPrivateV6() returns false, causing assertSafeUrl() to treat a loopback address as safe. Data flow, primary sink (authfetch): src/tools.ts:119, authfetch accepts user-controlled url: z.string() (source). src/tools.ts:128-131, handler calls navigateTo(ctx, url), passing the raw URL. src/browser.ts:58, navigateTo() calls assertSafeUrl(url). src/security.ts:74-108, assertSafeUrl() delegates IPv6 host validation to isPrivateV6(); hex-normalized loopback bypasses the check. src/browser.ts:66, page.goto(safeUrl.toString()) issues a browser request to the internal address. src/extractor.ts:33-54 / src/tools.ts:171-176, page content is extracted and returned to the MCP caller. Data flow, secondary sink (downloadmedia): src/tools.ts:198-210, downloadmedia accepts user-controlled urls[]. src/tools.ts:233-234, each URL passes through assertSafeUrl() then ctx.request.get(safeUrl.toString()). src/tools.ts:253-254, the response body is written to the local downloads directory and the path is returned. Dynamic confirmation (Phase 2): The PoC ran inside a Docker container (--network=host). Direct loopback URLs are correctly blocked: The IPv4-mapped IPv6 form bypasses the check and reaches the internal service: PoC Prerequisites: Terminal 1, start a loopback-only internal service: Terminal 2, start the MCP server (default config, no special env vars): MCP tool invocation: Expected vs. actual behavior: | URL | Expected | Actual | |---|---|---| | http://127.0.0.1:31337/ | BLOCK | BLOCK (correct) | | http://[::1]:31337/ | BLOCK | BLOCK (correct) | | http://[::ffff:127.0.0.1]:31337/ | BLOCK | ALLOW (vulnerable) | | http://[::ffff:7f00:1]:31337/ | BLOCK | ALLOW (vulnerable) | After the user clicks the "Capture" button, the MCP response contains INTERNALSECRETMARKER, confirming that the internal HTTP service was reached through the SSRF protection bypass. Remediation Decode the hex-encoded IPv4-mapped suffix before passing it to isPrivateV4(): Additionally, a BrowserContext route guard should be added in src/browser.ts to re-validate every navigation URL (including redirect targets) through assertSafeUrl(). No patched version available. Impact This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker who can supply or influence the url argument of the authfetch tool (or the urls[] array of downloadmedia) can direct the MCP server to make HTTP requests to services bound to 127.0.0.1 or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal. Who is impacted: End users running auth-fetch-mcp locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface, local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers. Server-side deployments: any deployment exposing auth-fetch-mcp as a shared MCP server faces the same risk against internal network services reachable from the host. The auth_fetch UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary. Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
CVE-2026-49857 has a CVSS score of 7.4 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (3.0.2). Upgrading removes the vulnerable code path.
npm
auth-fetch-mcp (<= 3.0.1)auth-fetch-mcp → 3.0.2 (npm)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2026-49857 is reachable in your applications. Explore AI application security for your team.
See if CVE-2026-49857 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2026-49857 in your environment →Upgrade auth-fetch-mcp to 3.0.2 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2026-49857 is a high-severity server-side request forgery (SSRF) vulnerability in auth-fetch-mcp (npm), affecting versions <= 3.0.1. It is fixed in 3.0.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
CVE-2026-49857 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
auth-fetch-mcp (npm) versions <= 3.0.1 is affected.
Yes. CVE-2026-49857 is fixed in 3.0.2. Upgrade to this version or later.
Whether CVE-2026-49857 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade auth-fetch-mcp to 3.0.2 or later.