CVE-2026-74858

This SSRF in fetcher-mcp isn't a missing guardrail — it's a structural impossibility baked into the tool's design. The MCP server's entire value proposition is fetching arbitrary URLs on behalf of AI agents. Unlike a web application that occasionally fetches user-controlled URLs, this tool is architecturally incapable of performing its core function without reaching into contexts it shouldn't access. That's the critical insight the CVSS 6.3 obscures: the vulnerability isn't a deviation from intent, it's the intent working exactly as designed. The AWS metadata path referenced in the advisory (/latest/meta-data/iam/security-credentials/) tells you everything about the real risk. This isn't a theoretical SSRF — it's the canonical path to credential theft, and its explicit appearance in the CVE description suggests either the researcher used it as proof-of-concept, or the tool operates in cloud contexts where metadata access is a realistic exposure. If your AI agent pipeline runs fetcher-mcp in an environment with attached IAM roles, this vulnerability converts directly into service account compromise. The CVSS assumes single-system impact; the actual blast radius flows through whatever cloud tools that IAM role can reach. The non-response from the maintainer is analytically significant. This pattern — rapid MCP tool deployment followed by maintenance abandonment — is systemic in this ecosystem. The question isn't whether a fix is coming; it's whether these tools should operate inside IAM trust boundaries at all. For defenders: first, audit whether fetcher-mcp or similar URL-fetching MCP tools are deployed in cloud environments with IAM role attachments. If they are, treat the exposure as credential theft, not just network boundary bypass. Second, deploy IMDSv2 (which requires PUT requests and tokens) as an environment-level control — input validation in the tool layer cannot reliably block metadata access. Third, assume these tools will not be patched and plan accordingly: isolate MCP servers from IAM-attached contexts, or accept that any URL fetcher in your agent pipeline is a potential credential exfiltration vector. The architectural question the MCP ecosystem hasn't answered is whether URL-fetching tools belong inside or outside infrastructure trust boundaries — and until that question is resolved, this class of vulnerability is structural, not fixable.

Reviewed through automated stages and approved by a human before publication.