# Marked Urgent Tonight. The Fetch Wheel Is Still Unguarded. > The primary is the Model Context Protocol reference fetch server, package mcp-server-fetch. NVD published CVE-2026-104120 on 2 October and lists versions up to 2026.6.4. On 4 October a maintainer marked the open report Urgent on the v2.0.0 milestone. The latest wheel, 2026.8.18, still follows redirects with no private-address check. Fence egress. Do not treat the newer tag as the patch. Source: https://hackerlogs.com/blog/mcp-fetch-urgent-still-open Published: 2026-10-04 ## Key takeaways - The primary is mcp-server-fetch in modelcontextprotocol/servers. NVD published CVE-2026-104120 on 2 October. VulDB is the CNA. The record is Deferred. Scores are 7.3 and 5.5. - On 4 October Cliff Hall put issue 4838 on milestone v2.0.0 and ranked it Urgent. The candidate pull request, 4890, is still a draft against main. - NVD stops the affected range at 2026.6.4. PyPI latest is 2026.8.18, uploaded 18 August. That wheel still follows redirects and has no private-address check. - The public report is 12 May. The reporter says three advisories went in on 5 June. Those advisory pages are not public. The README warning is not an egress fence. - The model chooses the URL. Deny private, loopback, link-local, and cloud metadata ranges from the host. A v2.0.0 milestone is not a ship date. Cliff Hall put the reference fetch server's missing address fence on milestone v2.0.0 tonight and ranked it Urgent. The package is mcp-server-fetch. [NVD published CVE-2026-104120](https://nvd.nist.gov/vuln/detail/CVE-2026-104120) on 2 October. The wheel an unpinned install resolves, 2026.8.18, still follows redirects and does not check where they land. US X trends on 4 October were the NFL. Hacker News was not this. The Hacker News and BleepingComputer already had the [GitLab gateway flaw](/blog/gitlab-cve-2026-90970) on 2 October. The clock that moved tonight is the fetch server. High because VulDB scored the CVE 7.3. On a cloud host the same fetch can return instance metadata into the model. The record's CVSS 4.0 score is 5.5 Medium. Read both. Three panels for the MCP reference fetch server: tonight's Urgent label on an open bug, the NVD range ending at 2026.6.4 against PyPI 2026.8.18, and the egress fence to put on the host. ## The primary is the reference fetch server. The primary is [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers), the reference collection operators copy, and the PyPI package mcp-server-fetch. NVD's description names that package and mcp-server-everything, through version 2026.6.4. That version string is the fetch calendar. The everything server in the same repo is a TypeScript demo, @modelcontextprotocol/server-everything at 2.0.0. This brief is the Python fetch wheel we opened. On current main, and in the 2026.8.18 wheel uploaded 18 August, the fetch path and the robots pre-check both follow redirects. The file has no private-address test. The [README caution](https://github.com/modelcontextprotocol/servers/blob/main/src/fetch/README.md) already says the server can access local and internal addresses and that operators should be careful. The recommended install is uvx with the package name and no pin. [Issue 4838](https://github.com/modelcontextprotocol/servers/issues/4838), opened 22 September from a static review, calls that an insecure default. Its author sent no proof of concept and did not file it as a novel CVE claim. VulDB did. NVD published the record on 2 October at 03:16 UTC, status Deferred, and wrote that the pull request to fix it awaits acceptance. The URL is an argument the model supplies. A page the agent was asked to read can steer the next fetch. What comes back enters the model context. On a cloud host, that reach includes instance metadata credentials. That is the identity clock, separate from the CVSS "low" confidentiality on a generic request forgery. ## Package clock versus impact clock. The package clock on the CVE page ends at 2026.6.4. PyPI shipped 2026.7.10 on 10 July and 2026.8.18 on 18 August. Both are newer than the line NVD drew. Neither added an address check. Upgrading to latest is how you install the unguarded client. The impact clock is older than the CVE. > NVD's range is the last version the CNA wrote down, not a fix line. The 2026.8.18 wheel still follows redirects twice and never tests the address. Deferred means NVD has not finished analysis. It does not withdraw the record, and it does not make uvx safe. [Issue 4143](https://github.com/modelcontextprotocol/servers/issues/4143) opened the public report on 12 May. Pull request 4226, a private-network guard against main, opened on 22 May and is still open. On 8 July, [issue 4492](https://github.com/modelcontextprotocol/servers/issues/4492) says three advisories were submitted on 5 June: two request-forgery reports and one path traversal. Those advisory pages return 404. The September comment on that issue describes the fetch gap in public. Issue 4143 was closed on 30 July. The May pull request was not merged. Draft [pull request 4890](https://github.com/modelcontextprotocol/servers/pull/4890) opened on 28 September against main. On 29 September its author marked it draft and asked whether a default deny would break intentional localhost fetches, and noted the patch still leaves a resolve-then-connect window. No maintainer answer is on that thread. ## What tonight's Urgent rank is not. It is not a release. At 22:26 UTC Hall labeled issue 4838 bug, server-fetch, and v2, and set milestone v2.0.0. Urgent is the priority on the tracker, not a fourth label. At 22:29 UTC he parented it under [issue 5004](https://github.com/modelcontextprotocol/servers/issues/5004), the Wave 2 tracker he opened a minute earlier. The fetch table lists 4838 as Urgent and names 4890 as the candidate pull request. That tracker says candidate pull requests against main are reference. Port them. Do not merge them to main. Wave 1 characterization suites pin current behavior, bugs included, and Wave 2 has to change those assertions in the same change as the fix. This morning's [pull request 4971](https://github.com/modelcontextprotocol/servers/pull/4971), fetch protocol tests on v2/main, is still open. It is the suite. It is not the fence. > A milestone named v2.0.0 does not tell you a date, and it does not change the wheel uvx will fetch tonight. Inventory the package. Fence the host. Wait for a release note that names the guard. This is also not the [MCP Python SDK issuer clock](/blog/mcp-python-sdk-issuer-clock). That one shipped a behaviour change on 7 September and an advisory on 28 September. This one has a CVE, a draft, and a latest wheel that still matches the vulnerable shape. It is not a generic web vulnerability you can hand to the edge proxy team and forget. The caller is the model. NVD's pairing with mcp-server-everything does not make the TypeScript demo the same artifact. If you run that demo, inventory it on its own package name. Do not close the fetch ticket by bumping it. ## What to do. 1. Find every install of mcp-server-fetch, including uvx with no version and the Docker image mcp/fetch from the README. Record the version. 2026.8.18 is not the fix. 2026.6.4 is not the only affected build. 2. Deny loopback, RFC1918, link-local, and cloud metadata ranges at egress from any host that runs the server. The application check is not in the release you can install. 3. On cloud hosts, require the metadata token and a hop limit. The credential is the impact that outlives the request. If a fetch already returned metadata into a transcript, rotate that role. 4. Keep localhost fetches on a host that does not also fetch the public web for a model. An explicit allow is a design choice. The README caution is not that choice. 5. Watch issue 5004 for a port of pull request 4890 onto the legacy server, with the characterization test changed in the same change. Do not treat a merge of the draft onto main, or a green Wave 1 suite, as the patch. 6. Leave the unpublished June advisory links as unpublished. When a public advisory appears, match it to fetch versus the path traversal before you close either ticket. The package clock says 2026.6.4. The impact clock has been open since May, and the wheel from August still has no fence. Tonight's Urgent label is the triage. It is not the ship. ## Sources - [CVE-2026-104120](https://nvd.nist.gov/vuln/detail/CVE-2026-104120) (2026-10-02) - [mcp-server-fetch follows redirects with no private-IP or metadata guard](https://github.com/modelcontextprotocol/servers/issues/4838) (2026-09-22) - [Wave 2: fix the known bugs the Wave 1 suites pin](https://github.com/modelcontextprotocol/servers/issues/5004) (2026-10-04) - [fix(fetch): guard against private-IP and cloud metadata SSRF](https://github.com/modelcontextprotocol/servers/pull/4890) (2026-09-28) - [GHSAs](https://github.com/modelcontextprotocol/servers/issues/4492) (2026-07-08) - [mcp-server-fetch 2026.8.18](https://pypi.org/project/mcp-server-fetch/2026.8.18/) (2026-08-18) - [Fetch MCP Server README](https://github.com/modelcontextprotocol/servers/blob/main/src/fetch/README.md)