CVE-2026-104120

Name of the Vulnerable Software and Affected Versions mcp-server-fetch versions prior to 2026.6.4 mcp-server-everything versions prior to 2026.6.4

Description A server-side request forgery (SSRF) issue exists in the Fetch Tool component. The vulnerability occurs within the fetch url() function located in the mcp server fetch/server.py file. A remote attacker can trigger this by manipulating the url or path arguments, allowing the server to make unauthorized requests to private IP addresses, loopback interfaces, or metadata services.

Recommendations Update mcp-server-fetch to version 2026.6.4 or later. Update mcp-server-everything to version 2026.6.4 or later. Implement egress filtering to deny traffic to RFC1918, loopback, and metadata addresses.