CVE-2026-74858
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in jae-jae fetcher-mcp up to 0.3.9 affects the fetch_url/fetch_urls function in the URL Validation component, allowing a Server-Side Request Forgery (SSRF) attack. The attack can be launched remotely.
Risk Assessment
An attacker could exploit SSRF to send requests to internal resources, potentially leading to unauthorized access to data or services.
Recommendation
Update fetcher-mcp to the latest available version or apply other mitigations, as the project has not responded to the report.
Original NVD description (English source)
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.