SSRF in mcp-server-fetch and everything server tools

Based on the provided webpage screenshot, here is a summary of the key vulnerability information: 1. SSRF in mcp-server-fetch: The fetch tool performs no internal/loopback/metadata IP filtering Vulnerability Overview Description: The tool in performs no validation on the target host when fetching user-provided URLs. It does not block loopback addresses, local cloud metadata addresses (e.g., 169.254.169.254), 0.0.0.0, or RFC1918 addresses, nor does it re-validate the target upon redirection. Details: - The only check performed is (syntax check). - The automatic redirect feature ( ) means that an apparently public URL, if redirected (302) to an internal target, will be followed without re-validation. - and are rejected for HTTPS requests; this vulnerability is limited to HTTP/HTTPS SSRF and does not include local file reading. Impact Scope Attackers can use LLM-generated prompt injection to force the server to request internal services and cloud instance metadata, returning the content to the model context. In version 2026.6.4, can read internal metadata from the sentinel server. Remediation Validate the target before fetching: Parse the host and reject loopback, local cloud metadata (169.254.0.0/16, including metadata IPs), 0.0.0.0/8, ULA/RFC1918, and other private/reserved ranges. Apply the same checks to fetching and re-validate after each redirect. Disable automatic redirects or validate each hop. Consider restricting connections to verified IPs to avoid DNS rebinding and limit allowed protocols to http/https. Optionally expose allowlist/denylist configurations to allow operators to constrain reachable hosts. POC Code 2. SSRF in the everything server's gzip-file-as-resource tool (empty domain allowlist by default) Vulnerability Overview Description: The tool in the server fetches user-provided http/https URLs and returns the gzip-compressed response as a resource. Its only domain restriction is , which defaults to an empty list, effectively meaning "allow all domains." Details: - There is no filtering for loopback, local cloud metadata, or private addresses. - Attackers can invoke the tool to force the server to request internal services and cloud metadata, reading (and decompressing) the response. - In version 2026.1.26, the server can read responses from the local sentinel server. Impact Scope Users running the server can use it as an SSRF proxy to request internal HTTP services and cloud metadata endpoints, returning content to the caller, with no domain restrictions by default. URLs can be controlled via LLM-generated prompt injection. is a widely used reference/demo MCP server and often runs with root privileges. Remediation Treat an empty as deny-all (or require explicit configuration) and add SSRF protection to : - Parse the host and reject loopback, local cloud metadata (169.254.0.0/16), 0.0.0.0/8, and private ranges. - Re-validate after each redirect and restrict connections to verified IPs. POC Code 3. Path traversal in get_file_contents path turns a scoped file read into an arbitrary GitHub-API request under the server PAT Vulnerability Overview Description: In and , the , , , and parameters are concatenated as strings to form the GitHub API URL, even though validation helpers exist in the codebase, they are not applied here. Details: - Path values containing fragments escape from the prefix, allowing attackers to read files outside the intended repository. - The token is appended unconditionally (see lines 28-29). - Unescaped in the path escapes the prefix and redirects the request to any endpoint. - In version 2025.4.8, using , , a crafted path returned a file from a different repository. Impact Scope Attackers can read and (via ) write GitHub resources beyond the intended repository and its permissions, including enumerating and reading private repositories owned by the token owner, by influencing the path parameter (which is controllable via LLM generation/prompt injection). A file read scoped to a single repository becomes an arbitrary GitHub API operation within the credential session. Remediation Validate and constrain parameters: Reject and any paths escaping from . After URL-encoding path segments, verify that the parsed request path remains within the expected prefix. Apply existing , , and checks to . Note: This package is deprecated; migration to the maintained GitHub MCP server is recommended. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

SSRF in mcp-server-fetch and everything server tools

More from this source