CVE-2026-104120

{
  "etk_id": "ETK-2026-411",
  "cve_id": "CVE-2026-104120",
  "display_id": "CVE-2026-104120",
  "ghsa_id": "GHSA-v78q-44mm-wf7q",
  "euvd_id": "EUVD-2026-91161",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in mcp-server-fetch Fetch Tool",
  "summary": "mcp-server-fetch and mcp-server-everything through 2026.6.4 are affected by server-side request forgery in the Fetch Tool. A remote attacker who can cause the tool to process a URL or path may make the host issue requests to unintended destinations.",
  "mitigation": "Disable the Fetch Tool where it is not required, and restrict its outbound network access to approved destinations. Treat versions through 2026.6.4 as affected and apply an upstream release containing the pending fix when one is published.",
  "vendor": "modelcontextprotocol",
  "product": "mcp-server-fetch",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "2026.6.0",
        "2026.6.1",
        "2026.6.2",
        "2026.6.3",
        "2026.6.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "mcp-server-fetch",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "2026.6.0",
        "2026.6.1",
        "2026.6.2",
        "2026.6.3",
        "2026.6.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "mcp-server-everything",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "epss_score": 0.0029,
  "epss_percentile": 0.2009,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.15575535,
  "t0_at": "2026-10-02T02:15:18.514000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T02:15:18.514000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T02:15:18.514000+00:00",
      "url": "https://github.com/advisories/GHSA-v78q-44mm-wf7q"
    }
  }
}