# CVE-2026-104120: CVE-2026-104120: The Official mcp-server-fetch Reference Server Reaches Loopback, Private and Cloud-Metadata Addresses, and Is Still Unpatched

> CVE-2026-104120 is a medium-severity prompt injection issue (CVSS 4.0) in mcp-server-fetch, a MCP server. Affected: <=2026.6.4.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-104120
- **Aliases:** ti-129
- **Severity:** medium
- **CVSS:** 4
- **Attack type:** Prompt injection, Server-side request forgery
- **Component:** mcp-server-fetch (MCP server)
- **Package:** mcp-server-fetch
- **Catalog entry:** https://catalog.anomity.ai/mcp/fetch-uvx
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-02
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-104120

## Summary

NVD published CVE-2026-104120 on 2 October 2026 from VulDB as CNA, with a CVSS 4.0 score of 5.5, for modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. The flaw first became public on 4 September 2026, when researcher geo-chen posted a full write-up and proof of concept on modelcontextprotocol/servers issue 4492, saying the private advisories had been filed on 5 June. The fetch tool (fetch_url) requests the URL with follow_redirects=True and checks nothing about the destination: it does not block loopback, RFC1918, link-local or the cloud metadata address 169.254.169.254, and its robots.txt pre-check uses the same unguarded client. Because the URL comes from the model, a prompt injection in fetched content can steer the server at internal services or instance metadata, and the response, which can include IMDS IAM credentials, returns into the model's context. A community fix (servers PR 4890, opened 28 September) adding private-IP and redirect validation was closed without being merged, so the official reference server remains unpatched. NVD lists the record as Deferred with no GitHub advisory, so scanners keyed on the GitHub Advisory Database may not flag it. The severity score understates the exposure on cloud hosts where IMDSv1 is reachable.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <=2026.6.4 | no fixed version listed |

## Am I affected by CVE-2026-104120?

You are affected if you run mcp-server-fetch <=2026.6.4.

## How do I fix CVE-2026-104120?

Treat mcp-server-fetch as unpatched. Do not run it on hosts that can reach cloud instance metadata or internal-only services, and enforce IMDSv2 with a hop limit of 1 (or block 169.254.169.254) where it does run. If it is required, run it in a sandbox or container whose egress allows only public destinations, or behind an egress proxy that refuses private, loopback and link-local addresses including after redirects. Do not let agents fetch URLs autonomously from untrusted content, review the fetch tool's requests in agent logs for internal hosts, and track modelcontextprotocol/servers for an official fix.

## How do I find every machine running mcp-server-fetch?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run mcp-server-fetch and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-104120

## Related vulnerabilities

- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [forever-security-an-agents-md-planted-in-downloads-got-codex-to](https://catalog.anomity.ai/vuln/forever-security-an-agents-md-planted-in-downloads-got-codex-to) — high
- [CVE-2026-103091](https://catalog.anomity.ai/vuln/cve-2026-103091) — critical
- [CVE-2026-103572](https://catalog.anomity.ai/vuln/cve-2026-103572) — high
- [CVE-2026-108592](https://catalog.anomity.ai/vuln/cve-2026-108592) — high
- [mcp-server-discover-instructions-field-can-inject-before-the-first-tool](https://catalog.anomity.ai/vuln/mcp-server-discover-instructions-field-can-inject-before-the-first-tool) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-104120