CVE-2026-49857

{"id": "CVE-2026-49857", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49857", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:50:08.906500Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ymw0407", "product": "auth-fetch-mcp", "versions": [{"status": "affected", "version": "< 3.0.2"}]}]}], "published": "2026-08-13T15:19:41.743", "references": [{"url": "https://github.com/ymw0407/auth-fetch-mcp/commit/c5c523cd55b24ae1680c5bacef95d59a81ae3450", "source": "security-advisories@github.com"}, {"url": "https://github.com/ymw0407/auth-fetch-mcp/releases/tag/v3.0.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/ymw0407/auth-fetch-mcp/security/advisories/GHSA-pvrj-8cg3-j5f8", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue."}, {"lang": "es", "value": "auth-fetch-mcp es un servidor MCP que permite a los asistentes de IA obtener contenido de p\u00e1ginas web autenticadas. La versi\u00f3n 3.0.1 implementa protecci\u00f3n SSRF en \u2019assertSafeUrl()\u2019 (\u2019src/security.ts\u2019) para bloquear solicitudes a direcciones privadas y de bucle invertido. Sin embargo, la funci\u00f3n \u2019isPrivateV6()\u2019 no detecta las direcciones de bucle invertido IPv6 mapeadas a IPv4 en su forma hex-normalizada. Cuando un atacante proporciona una URL como \u2019http://[::ffff:127.0.0.1]:PUERTO/\u2019, el analizador de URL WHATWG de Node.js normaliza silenciosamente el host a \u2019[::ffff:7f00:1]\u2019. Debido a que \u2019net.isIPv4(\u20197f00:1\u2019)\u2019 devuelve \u2019false\u2019, la verificaci\u00f3n de IP privada se omite y la URL se pasa al navegador o cliente HTTP, permitiendo que la herramienta MCP acceda a servicios de bucle invertido que se supone que deben estar bloqueados. El problema es explotable bajo la configuraci\u00f3n predeterminada sin ninguna variable de entorno especial. La versi\u00f3n 3.0.1 corrige el problema."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}