The vulnerability allows an attacker to bypass SSRF protection in the MCP server by exploiting a mis-handled IPv4‐mapped IPv6 loopback address that eludes the URL parser. This bypass enables a local service call that was intended to be blocked, giving the attacker the ability to read local data or execute other internal actions. This flaw is classified as a classic SSRF weakness (CWE‑918) and can result in confidentiality and integrity risks of internal resources.

Auth‑fetch‑mcp, a server used by AI assistants to fetch content from authenticated web pages, is affected. Versions older than 3.0.1 are vulnerable as they do not contain the patch that fixes the IPv4‑mapped IPv6 loopback detection. The fix is included in release 3.0.1 and later.

The CVSS score of 7.4 indicates a high severity vulnerability. While EPSS data is unavailable, the lack of an exploit listed in KEV suggests no widespread exploitation yet, but the attack path is straightforward and requires only the ability to supply a URL to the MCP server. The default configuration is permissive, so no special environment variable is needed, meaning the vulnerability can be leveraged by any user who can control the content fetched by the assistant. The attacker can use the URL sanitizer to point to localhost or other internal services, retrieve data, and potentially disrupt the service.