{"items":[{"id":"NVI-00017500","kind":"vulnerability","title":"auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pvrj-8cg3-j5f8","CVE-2026-49857"],"plain_summary":"GitHub lists this reviewed advisory for auth-fetch-mcp. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0bcd88d6cdb1c66d8733f3b2f48af5d0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-01T18:16:23.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0bcd88d6cdb1c66d8733f3b2f48af5d0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0bcd88d6cdb1c66d8733f3b2f48af5d0","url":"https://github.com/advisories/GHSA-pvrj-8cg3-j5f8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pvrj-8cg3-j5f8","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:49:14.191Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0bcd88d6cdb1c66d8733f3b2f48af5d0"],"technology":"auth-fetch-mcp","known_exclusions":[],"conditions_summary":"## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback\n\n### Summary\n\n`auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**.\n\n### Details\n\nThe vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools.\n\n**Root cause — `src/security.ts:46-50`:**\n\n```ts\nif (lower.startsWith(\"::ffff:\")) {\n  const v4 = lower.slice(7);          // \"7f00:1\" after Nod","public_affected_ranges":["<= 3.0.1"]}],"null_published_at":"2026-11-05T19:10:21.398Z","source_updated_at":"2026-07-01T18:16:23.000Z","source_disclosed_at":"2026-07-01T18:16:22.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:49:14.191Z"}],"next_cursor":null,"snapshot_revision":"42594"}