CVE-2026-80347
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a bracketed value, so the branch holding the private-address checks is skipped entirely. The guard falls back to resolving the hostname, the bracketed string is not a resolvable name, no addresses are returned, and the target is reported safe. The HTTP client then strips the brackets and connects. Because the address may be given in IPv4-mapped form, the same path reaches any IPv4 target the loopback and private checks were meant to exclude, including link-local metadata endpoints. isPrivateIPv6 also has no case for the ::ffff: prefix, so the mapped form would still pass even if the brackets were removed. The fetch target is supplied as a tool argument, so an attacker who can influence what the model requests can read internal responses back into the model context.
Risk Assessment
An attacker can exploit SSRF to access internal resources and metadata, potentially leading to data leakage or privilege escalation in the model environment.
Recommendation
Update mcp-fetch to a patched version that strips brackets before SSRF checks and handles the IPv4-mapped IPv6 range.
Related vulnerabilities
- CVE-2026-120198Critical
A vulnerability was found in WAVLINK WL-WN530BE1-A V251117 in the con_check_read_finish function of /protocol.csp. Manipulation of the group_name/IP-FROM argument leads to command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-120197Critical
A flaw was found in WAVLINK WL-WN530HG4B (version M_V260724) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument leads to OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-120196Critical
A vulnerability was detected in WAVLINK WN579X3-D (version V250402) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument results in OS command injection. The attack may be performed remotely and the exploit is publicly available.
- CVE-2026-120195Critical
A security vulnerability was detected in WAVLINK WL-WN579A3-A (version 2026-03-10-94f93d4) in the set_wzdgwMesh function of /cgi-bin/adm.cgi, within the Initial Setup Wizard component. Manipulation of the wlan_ssid argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-120189Critical
A vulnerability was identified in D-Link DIR-505 1.10B02 in the save_upload_file/mp_upload_file function of /usr/bin/tftpd, which handles TFTP upload filenames. Manipulation of input leads to a stack-based buffer overflow. The attack can be carried out remotely, and a public exploit is available and might be used.
- CVE-2026-118636Critical
The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.
- CVE-2026-120209Critical
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
- CVE-2026-120201Critical
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
- CVE-2026-118235Critical
The SimpleForm plugin for WordPress (versions up to and including 3.10.2) is vulnerable to arbitrary file upload via the handle_upload function. Missing a server-side file key allowlist and pre-sanitization extension derivation allows a trailing-dot filename to bypass all extension and MIME validation, enabling unauthenticated attackers to upload executable files and achieve remote code execution. The only access control is a nonce printed into every public form's data-nonce attribute, trivially obtainable by any unauthenticated visitor.
- CVE-2026-103882Critical
The Acadlix LMS plugin for WordPress (versions up to and including 1.1.9) is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function. Authenticated attackers with subscriber-level access or higher can delete arbitrary files on the server, potentially leading to remote code execution when critical files such as wp-config.php are deleted. The route's permission callback only verifies a generic wp_rest nonce emitted in the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.
Original NVD description (English source)
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a bracketed value, so the branch holding the private-address checks is skipped entirely. The guard falls back to resolving the hostname, the bracketed string is not a resolvable name, no addresses are returned, and the target is reported safe. The HTTP client then strips the brackets and connects. Because the address may be given in IPv4-mapped form, the same path reaches any IPv4 target the loopback and private checks were meant to exclude, including link-local metadata endpoints. isPrivateIPv6 also has no case for the ::ffff: prefix, so the mapped form would still pass even if the brackets were removed. The fetch target is supplied as a tool argument, so an attacker who can influence what the model requests can read internal responses back into the model context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS