THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-49857 (HIGH 7.4) — auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails t

[NVD] CVE-2026-49857 (HIGH 7.4) — auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails t

lownvdPublished 2026-08-13

CVE-2026-49857 CVSS: 7.4 HIGH Published: 2026-08-13T15:19:41.743

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their

Indicators of compromise

CVE-2026-49857cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-49857