Marked Urgent Tonight. The Fetch Wheel Is Still Unguarded.

Cliff Hall put the reference fetch server's missing address fence on milestone v2.0.0 tonight and ranked it Urgent. The package is mcp-server-fetch. NVD published CVE-2026-104120 on 2 October. The wheel an unpinned install resolves, 2026.8.18, still follows redirects and does not check where they land.

US X trends on 4 October were the NFL. Hacker News was not this. The Hacker News and BleepingComputer already had the GitLab gateway flaw on 2 October. The clock that moved tonight is the fetch server.

High High because VulDB scored the CVE 7.3. On a cloud host the same fetch can return instance metadata into the model. The record's CVSS 4.0 score is 5.5 Medium. Read both.

The primary is the reference fetch server.#

The primary is modelcontextprotocol/servers, the reference collection operators copy, and the PyPI package mcp-server-fetch. NVD's description names that package and mcp-server-everything, through version 2026.6.4. That version string is the fetch calendar. The everything server in the same repo is a TypeScript demo, @modelcontextprotocol/server-everything at 2.0.0. This brief is the Python fetch wheel we opened.

On current main, and in the 2026.8.18 wheel uploaded 18 August, the fetch path and the robots pre-check both follow redirects. The file has no private-address test. The README caution already says the server can access local and internal addresses and that operators should be careful. The recommended install is uvx with the package name and no pin.

Issue 4838, opened 22 September from a static review, calls that an insecure default. Its author sent no proof of concept and did not file it as a novel CVE claim. VulDB did. NVD published the record on 2 October at 03:16 UTC, status Deferred, and wrote that the pull request to fix it awaits acceptance.

The URL is an argument the model supplies. A page the agent was asked to read can steer the next fetch. What comes back enters the model context. On a cloud host, that reach includes instance metadata credentials. That is the identity clock, separate from the CVSS "low" confidentiality on a generic request forgery.

Package clock versus impact clock.#

The package clock on the CVE page ends at 2026.6.4. PyPI shipped 2026.7.10 on 10 July and 2026.8.18 on 18 August. Both are newer than the line NVD drew. Neither added an address check. Upgrading to latest is how you install the unguarded client.

The impact clock is older than the CVE.

Issue 4143 opened the public report on 12 May. Pull request 4226, a private-network guard against main, opened on 22 May and is still open. On 8 July, issue 4492 says three advisories were submitted on 5 June: two request-forgery reports and one path traversal. Those advisory pages return 404. The September comment on that issue describes the fetch gap in public. Issue 4143 was closed on 30 July. The May pull request was not merged.

Draft pull request 4890 opened on 28 September against main. On 29 September its author marked it draft and asked whether a default deny would break intentional localhost fetches, and noted the patch still leaves a resolve-then-connect window. No maintainer answer is on that thread.

1. 2026-05-12
   Issue 4143 reports that mcp-server-fetch has no guard on private or metadata addresses.
2. 2026-05-22
   Pull request 4226 proposes the guard. It is still open against main.
3. 2026-06-05
   The reporter says three advisories were submitted. The pages are not public.
4. 2026-08-18
   PyPI publishes mcp-server-fetch 2026.8.18. The wheel still follows redirects.
5. 2026-09-28
   Draft pull request 4890 opens. NVD later cites it as the fix that awaits acceptance.
6. 2026-10-02
   NVD publishes CVE-2026-104120 at 03:16 UTC. Status Deferred. Scores 7.3 and 5.5.
7. 2026-10-04
   Cliff Hall ranks issue 4838 Urgent on milestone v2.0.0 and opens the Wave 2 tracker.

What tonight's Urgent rank is not.#

It is not a release. At 22:26 UTC Hall labeled issue 4838 bug, server-fetch, and v2, and set milestone v2.0.0. Urgent is the priority on the tracker, not a fourth label. At 22:29 UTC he parented it under issue 5004, the Wave 2 tracker he opened a minute earlier. The fetch table lists 4838 as Urgent and names 4890 as the candidate pull request.

That tracker says candidate pull requests against main are reference. Port them. Do not merge them to main. Wave 1 characterization suites pin current behavior, bugs included, and Wave 2 has to change those assertions in the same change as the fix. This morning's pull request 4971, fetch protocol tests on v2/main, is still open. It is the suite. It is not the fence.

This is also not the MCP Python SDK issuer clock. That one shipped a behaviour change on 7 September and an advisory on 28 September. This one has a CVE, a draft, and a latest wheel that still matches the vulnerable shape. It is not a generic web vulnerability you can hand to the edge proxy team and forget. The caller is the model.

NVD's pairing with mcp-server-everything does not make the TypeScript demo the same artifact. If you run that demo, inventory it on its own package name. Do not close the fetch ticket by bumping it.

What to do.#

1. Find every install of mcp-server-fetch, including uvx with no version and the Docker image mcp/fetch from the README. Record the version. 2026.8.18 is not the fix. 2026.6.4 is not the only affected build.
2. Deny loopback, RFC1918, link-local, and cloud metadata ranges at egress from any host that runs the server. The application check is not in the release you can install.
3. On cloud hosts, require the metadata token and a hop limit. The credential is the impact that outlives the request. If a fetch already returned metadata into a transcript, rotate that role.
4. Keep localhost fetches on a host that does not also fetch the public web for a model. An explicit allow is a design choice. The README caution is not that choice.
5. Watch issue 5004 for a port of pull request 4890 onto the legacy server, with the characterization test changed in the same change. Do not treat a merge of the draft onto main, or a green Wave 1 suite, as the patch.
6. Leave the unpublished June advisory links as unpublished. When a public advisory appears, match it to fetch versus the path traversal before you close either ticket.

The package clock says 2026.6.4. The impact clock has been open since May, and the wheel from August still has no fence. Tonight's Urgent label is the triage. It is not the ship.