mcp‑fetch performs an SSRF guard that checks the hostname of a requested URL, but it incorrectly leaves IPv6 literals surrounded by brackets intact. A URL such as http://[::1]/ is parsed as a bracketed string, causing the isIP test to fail and the private‑address checks to be skipped. The guard then resolves the hostname, finds no routable address, and declares the target safe, after which the client strips the brackets and connects. This flaw permits an attacker who can influence the fetch target—through a tool argument or model input—to initiate requests to loopback, link‑local, and other private IP ranges that the guard was meant to block, exposing internal services or metadata endpoints. The vulnerability is a Server‑Side Request Forgery identified as CWE‑918.

The issue affects the Kazuph mcp‑fetch package versions up through 1.6.3; any deployment using these or earlier versions and allowing external input to specify the fetch target is vulnerable. No other vendors or products are listed.

The CVSS score of 8.7 depicts high severity, and although the EPSS score is not available, the existence of the flaw and its ability to reach internal resources means the exploitation probability could be significant, especially in environments where the tool is exposed to untrusted input. The vulnerability is not currently listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not yet been documented. The likely attack vector is an attacker controlling the fetch target argument to perform SSRF against internal addresses; without network restrictions, this can lead to confidential data leakage into the requesting process.