auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback (CVE-2026-49857) | HOL Guard CVE

High · CVSS 7.4CVE-2026-49857GHSA-PVRJ-8CG3-J5F8

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

Answer in brief

CVE-2026-49857 records a High severity (CVSS 7.4) vulnerability in auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback. The current sources do not mark it as known exploited. The current feed maps ymw0407/auth-fetch-mcp (generic), auth-fetch-mcp (npm). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 13, 2026Updated Aug 13, 2026Source checked Sep 17, 2026First seen by HOL Jul 1, 2026Material review Aug 13, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.4
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps ymw0407/auth-fetch-mcp (generic), auth-fetch-mcp (npm). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ymw0407/auth-fetch-mcpgeneric	< 3.0.2	Not reported
auth-fetch-mcpnpm	<=3.0.1	3.0.2

Recommended response

Check inventory. Check lockfiles and deployed manifests for ymw0407/auth-fetch-mcp, auth-fetch-mcp.
Review the reported fix. Update auth-fetch-mcp to 3.0.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 1, 2026

Sources and claim methodology

Upstream source description

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.

Quoted source text, attributed separately from HOL analysis.