mcp-fetch's SSRF Guard Skipped Every Private-Address Check on Bracketed IPv6 (CVE-2026-80347, 8.7)

NVD·high signalXBlueskyLinkedInCopy link

NVD published CVE-2026-80347 on 2026-08-26 against kazuph/mcp-fetch through 1.6.3. isSafeUrl reads the hostname from the parsed URL, which for http://[::1]/ yields the bracketed string, then tests it with net.isIP; that returns zero for a bracketed value, so the entire private-address branch is skipped, DNS resolution of the bracketed string returns nothing, and the target is declared safe before the HTTP client strips the brackets and connects. Because the address can be given in IPv4-mapped ::ffff: form, this reaches any IPv4 target the loopback checks existed to block, including metadata endpoints, and the fetch URL is a tool argument, so prompt injection is a sufficient trigger.