Summary
CVE-2026-104120 is a server-side request forgery vulnerability in the Fetch Tool provided by mcp-server-fetch and mcp-server-everything. A remote attacker may be able to influence the requested URL or path, causing the server to make unintended network requests to internal or otherwise restricted destinations.
Affected context
The vulnerability occurs in deployments of the MCP Fetch Tool where the fetch_url function processes attacker-influenced URL or path values. Risk is higher when the server can reach internal services, cloud metadata endpoints, administrative interfaces, or other network zones that are not directly accessible to the requester.
Exploit preconditions
- Attack surface: The remotely accessible MCP Fetch Tool or an interface that invokes it
- Required access: Ability to submit or influence a URL or path accepted by the fetch functionality
- Trigger point: Processing the supplied value by
fetch_urlinmcp_server_fetch/server.py - Why exploitation is possible: The server may perform outbound requests without sufficiently restricting destinations, protocols, address ranges, or redirect targets
Why this happens
The underlying issue is an insufficient separation between user-controlled request destinations and trusted server network access. When a server accepts attacker-influenced URLs or paths and uses them for outbound requests without robust destination validation, it can be induced to act as a proxy to internal or restricted resources. This behavior maps to CWE-918: Server-Side Request Forgery (SSRF).
Potential impact
- An attacker may retrieve information from internal services
- Restricted administrative endpoints could be reached through the vulnerable server
- Cloud or platform metadata may be exposed where network controls permit access
- The server could be used to scan reachable network services
- Internal systems may receive unintended requests originating from a trusted network position
General mitigation guidance
Mitigation generally focuses on making outbound requests safe by default and reducing the trust placed in user-controlled destinations.
Common defensive patterns include:
- Allowing only explicitly approved schemes, hosts, ports, and destination networks
- Blocking loopback, link-local, private, multicast, and reserved address ranges where they are not required
- Resolving hostnames and validating the resulting addresses before connecting
- Revalidating destinations after redirects and preventing unrestricted redirect chains
- Restricting outbound network access with egress controls, proxies, and segmentation
- Running the fetch service with the minimum network and operating-system privileges necessary
- Avoiding direct access to sensitive metadata and administrative interfaces
- Applying response-size, timeout, and connection limits to reduce abuse
How teams detect issues like this
Detection can combine code review, automated analysis, and runtime monitoring.
Useful approaches include:
- Searching for request clients that consume user-controlled URLs or paths without allowlists
- Reviewing hostname resolution, redirect handling, IP-range validation, and protocol checks
- Using static analysis or automated security review tools to identify SSRF-prone data flows
- Enforcing policies that require approved outbound destinations for server-side fetch features
- Monitoring outbound requests from the service to private, loopback, link-local, metadata, and unexpected external addresses
- Recording destination, redirect, response, and denial events without exposing sensitive response contents
