mcp-server-fetch SSRF guard classifies internal IPv6 site-local address as public
The address guard in mcp-server-fetch wrongly classifies an internal IPv6 site-local address as public, letting a fetch bypass the SSRF check meant to refuse non-public destinations, researchers at ShieldPi report.
- Affected
- >= 2026.10.10, < 2026.11.11
- Fixed
- 2026.11.11
The guard omits the site-local range fec0::/10 and the IPv4-translated range ::ffff:0:0/96 from its non-public list, then falls back to Python's is_global, which reports fec0::1 as True. ShieldPi reproduced the misclassification on versions 2026.11.4 and 2026.10.24; the translated loopback form [::ffff:0:127.0.0.1] was correctly blocked.
Advisory metadata lists affected versions as >= 2026.10.10 and < 2026.11.11, with the fix in 2026.11.11. Default hosts usually lack a route to fec0::/10, so the connection typically times out; the advisory rates the flaw Low and calls it a defense-in-depth gap rather than a proven metadata-service exploit. Deployments relying on the address guard should update to 2026.11.11.
Sources & technical scope 1 source
MCP server advisories — original source ↗
Affected: >= 2026.10.10, < 2026.11.11
Fixed: 2026.11.11
Exploitation: Classifier bypass reproduced on tested versions; Low severity; not a proven metadata-service exploit on default hosts
Scope & limitations: Not established by supplied evidence: whether any real host routes fec0::/10, whether the bypass yields data access, or patch mechanics beyond the version number.
External findings belong to the credited researchers.