Unverified50% confidenceFactExact time
mcp-server-fetch fixes an issue in internationalized domain name (IDNA) scenarios where one form of a domain is checked but another form is connected to, potentially reaching internal network addresses (GHSA-v38p-wf49-hx2j).
1
Sources
50%
Confidence
Long-term
Relevance
10/25/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiedmcp-server-fetch 2026.10.24 addresses three network-request-related issues, with the approach being to make the address that is checked the address that is connected to.69% similarUnverifiedSiteCheck offers both OpenAPI and a remote MCP server as access methods, and the MCP endpoint address is https://api.sitecheck-api.workers.dev/mcp.65% similarUnverifiedWhen constructing outbound requests, the MCP server directly uses the address provided by the Agent, without verifying where that address actually resolves to, which attackers can exploit to make the server access internal networks, cloud metadata interfaces, or other sensitive resources.63% similarUnverifiedThe Fetch MCP server by default rejects private, loopback, and link-local addresses (including the cloud metadata endpoint 169.254.169.254), and re-checks the target IP on every redirect hop.62% similarUnverifiedVerification against https://minia2a.uk/mcp shows: a POST sending the initialize method returns HTTP/2 200 with content-type application/json and sets Mcp-Session-Id, and the serverInfo response contains name and version.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1094934API
curl https://kongchang.com/api/v1/knowledge/claims/1094934MCP
get_claim(id=1094934)