ECHOS advisory
fetcher-mcp: no authentication on the HTTP transport, and no destination check on URL fetching
The HTTP transport in fetcher-mcp has no authentication on its /mcp, /sse and /messages routes. It listens on localhost by default. It is reachable from the network only when the operator sets --host=0.0.0.0, which the project's README documents. The fetch_url and fetch_urls tools check that a URL uses http or https and check nothing else about the destination, so loopback, private-range and link-local addresses are accepted.
Advisory
Affected
fetcher-mcp: every version through 0.3.9, the latest on npm (published 2026-01-14).
Not fixed
Not fixed.
Severity
Unauthenticated HTTP transport: CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), CWE-306, by our own assessment.
Server-side request forgery: CVSS 3.1 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), CWE-918, by our own assessment.
Identifiers
Unauthenticated HTTP transport: CVE requested from MITRE 2026-08-17, not yet assigned.
Server-side request forgery: CVE requested from MITRE 2026-08-17, not yet assigned.
How it was found
The HTTP transport in fetcher-mcp has no authentication on its /mcp, /sse and
/messages routes. It listens on localhost by default. It is reachable from the network
only when the operator sets --host=0.0.0.0, which the project's README documents.
The fetch_url and fetch_urls tools check that a URL uses http or https and check nothing else about the destination, so loopback, private-range and link-local addresses are accepted.
Found by reading the source at commit 8754aff66e3d9207502207bf82a493f45f556bb8 (main, 0.3.9), re-read on 2026-09-29.
Neither behavior was demonstrated against any third-party host.
Disclosure timeline
| Date | Event |
|---|---|
| 2026-07-08 | The request-forgery issue was reported publicly by another researcher, in issue #38 in the fetcher-mcp repository. |
| 2026-07-22 | Reported by email to the address in the repository commit history. |
| August 2026 | In-thread follow-up. |
| 2026-08-17 | Submitted to MITRE as CNA-LR requests. |
| 2026-10-05 | Escalated to the GitHub security team (referred to GitHub Support). |
| 2026-10-20 | Publication, day 90. |
No response from the maintainer received.
Reproduction
Pass a loopback address, http://127.0.0.1/, as the URL to fetch_url or fetch_urls. The
tool accepts it, because the only check is that the URL uses http or https.
Link-local addresses are accepted in the same way. No path is shown here, and none was requested from any host.
What was not tested
No third-party host was tested. Severity scores are our own assessment. Identifiers: CVE requested from MITRE 2026-08-17, not yet assigned (HTTP transport); CVE requested from MITRE 2026-08-17, not yet assigned (request forgery).
Credit
Found independently by ECHOS, Stonepath IT. The request-forgery issue was first reported publicly in issue #38.