Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80347— mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets

Quick assessment

Affected
kazuph mcp-fetch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mcp-fetch 在检查 SSRF 防护时，未移除包裹 IPv6 字面量的方括号。 函数从解析后的 URL 中提取主机名；对于形如 的字面量，提取出的主机名仍包含方括号。随后，该函数使用 进行检测，但由于传入的是带方括号的字符串， 返回 0，导致跳过包含私有地址检查的逻辑分支。 此时，防护机制回退到解析主机名的方式。由于带方括号的字符串并非可解析的主机名，无法获得任何 IP 地址，因此目标被错误地判定为安全。随后，HTTP 客户端会移除方括号并发起连接。 由于 IPv4 映射地址可能以 前缀形式出现，同一攻击路径

CVSS 7.5 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
kazuph mcp-fetch ≤ 1.6.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80347

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets
Source: CVE Program / CVE List V5
Vulnerability Description
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a bracketed value, so the branch holding the private-address checks is skipped entirely. The guard falls back to resolving the hostname, the bracketed string is not a resolvable name, no addresses are returned, and the target is reported safe. The HTTP client then strips the brackets and connects. Because the address may be given in IPv4-mapped form, the same path reaches any IPv4 target the loopback and private checks were meant to exclude, including link-local metadata endpoints. isPrivateIPv6 also has no case for the ::ffff: prefix, so the mapped form would still pass even if the brackets were removed. The fetch target is supplied as a tool argument, so an attacker who can influence what the model requests can read internal responses back into the model context.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
kazuph mcp-fetch 0 ~ 1.6.3 -

II. Public POCs for CVE-2026-80347

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80347

请登录查看更多情报信息。

Other References for CVE-2026-80347 (3)

IV. Related Vulnerabilities

Same vendor: kazuph
Same weakness: CWE-918

V. Comments for CVE-2026-80347

No comments yet

Leave a comment