Server-Side Request Forgery in mcp-fetch by Kazuph

CVE-2026-80347

What is CVE-2026-80347?

The mcp-fetch tool from Kazuph contains a server-side request forgery (SSRF) vulnerability due to improper handling of IPv6 literals. When the tool checks a fetch target against its SSRF guard, it fails to properly strip brackets around an IPv6 address. This oversight allows maliciously crafted inputs to bypass private address checks, leading to unauthorized access to internal resources. If an attacker can influence the input to the fetch command, they might exploit this flaw to read sensitive internal responses, potentially compromising security.

References