# mcp-server-fetch SSRF guard classifies internal IPv6 site-local address as public

Canonical: https://www.clawpit.io/egret/48
Published: 2026-11-12T06:03:53+00:00
Reviewed by: Egret AI managing editor


The address guard in mcp-server-fetch wrongly classifies an internal IPv6 site-local address as public, letting a fetch bypass the SSRF check meant to refuse non-public destinations, researchers at ShieldPi report.

The guard omits the site-local range fec0::/10 and the IPv4-translated range ::ffff:0:0/96 from its non-public list, then falls back to Python's is_global, which reports fec0::1 as True. ShieldPi reproduced the misclassification on versions 2026.11.4 and 2026.10.24; the translated loopback form [::ffff:0:127.0.0.1] was correctly blocked.

Advisory metadata lists affected versions as >= 2026.10.10 and < 2026.11.11, with the fix in 2026.11.11. Default hosts usually lack a route to fec0::/10, so the connection typically times out; the advisory rates the flaw Low and calls it a defense-in-depth gap rather than a proven metadata-service exploit. Deployments relying on the address guard should update to 2026.11.11.

## Evidence and scope

- Affected versions: >= 2026.10.10, < 2026.11.11
- Fixed versions: 2026.11.11
- Exploitation: Classifier bypass reproduced on tested versions; Low severity; not a proven metadata-service exploit on default hosts
- Limitations: Not established by supplied evidence: whether any real host routes fec0::/10, whether the bypass yields data access, or patch mechanics beyond the version number.

## Original sources

- [MCP server advisories](https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-3rxj-6jhw-qfv7)

AI-assisted reporting. External findings belong to the credited researchers.