CVE-2026-74858: jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetchurl/fetchurls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74858?
The severity of CVE-2026-74858 is classified as medium with a score of 6.3.
What is CVE-2026-74858?
CVE-2026-74858 is a vulnerability in the jae-jae fetcher-mcp that allows server-side request forgery (SSRF) due to improper URL validation.
How can I mitigate CVE-2026-74858?
To mitigate CVE-2026-74858, upgrade to jae-jae fetcher-mcp version 0.3.10 or later, which addresses the SSRF issue.
Can CVE-2026-74858 be exploited remotely?
Yes, CVE-2026-74858 can be exploited remotely due to its nature involving server-side request forgery.
What components are affected by CVE-2026-74858?
The affected components in CVE-2026-74858 include the fetch_url and fetch_urls functions in the URL Validation of jae-jae fetcher-mcp.