{"id":"GHSA-v38p-wf49-hx2j","kind":"vulnerability","aliases":["GHSA-v38p-wf49-hx2j"],"related":[],"title":"fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names)","description":"### Summary\n\nThe private-address guard added in `mcp-server-fetch` 2026.10.10 checks a different hostname than\r\nthe one httpx connects to when the URL has an internationalized (IDNA) host: the guard resolves the\r\nIDNA 2003 form (`faß` becomes `fass`) while httpx connects to the IDNA 2008 form (`xn--fa-hia`).\r\nAnyone who controls a domain can point the two names at a public and an internal address and reach\r\nloopback, private-network or cloud-metadata endpoints through the `fetch` tool in its default\r\nconfiguration, which the README says refuses those addresses. Severity: CVSS 4.0 6.3 (Medium); the\r\nCVSS 3.1 equivalent is 7.4 (High).\n\n### Details\n\n`mcp-server-fetch` 2026.10.10 added a guard that refuses loopback, private, link-local and cloud\r\nmetadata addresses by default (PR #5033, the fix for the SSRF tracked as CVE-2026-104120). The guard\r\nis an httpx request hook, `_refuse_private_destination`, which resolves `request.url.host` with\r\n`getaddrinfo` and refuses the request if any address is not public\r\n(`src/fetch/src/mcp_server_fetch/server.py` L119-L143 at tag v1.0.0,\r\n`c003d0d807409b22fa640d1f8e11f38f15755721`, which is the published 2026.10.10 code). The fetch README\r\nstates that by default the server refuses non-public addresses, including cloud metadata endpoints,\r\nand lists two limits: DNS rebinding between the check and the connection, and hostnames the server\r\ncannot resolve itself (proxy-only names). The issue below is neither. It is still present on the\r\ndevelopment line (`v2/main` at `6d613ecff7d320e0e0414a997f46bc4b3367c50d`, `server.py` L140-L154).\r\n\r\nFor an internationalized hostname the hook and the connection resolve different names:\r\n\r\n- httpx stores the host IDNA 2008 encoded (`URL.raw_host`, e.g. `xn--fa-hia.attacker.example`) and\r\n  connects to that name.\r\n- `URL.host`, which the hook passes to `getaddrinfo`, is the decoded Unicode form\r\n  (`faß.attacker.example`). CPython's `socket.getaddrinfo` encodes a Unicode name with the built-in\r\n  `idna` codec, which is IDNA 2003 and maps `ß` to `ss`, so the hook looks up\r\n  `fass.attacker.example`.\r\n\r\nThe domain owner points `fass.` at any public address and `xn--fa-hia.` at an internal one. The hook\r\napproves the public answer and httpx connects to the internal address. There is no timing involved,\r\nso this is separate from the documented DNS-rebinding limit.\r\n\r\nThe same mismatch also reaches the documented proxy-only branch (L130-L133, which skips the check\r\nwhen the hook's lookup fails) for a name the server does resolve: if the IDNA 2003 name does not\r\nexist, the hook skips the check, and httpx resolves the IDNA 2008 name itself and connects directly,\r\nwith no proxy configured. The fix below covers both.\r\n\r\nBoth apply to the URL the model passes to the `fetch` tool and to every redirect hop, since all of\r\nthem go through the same hook. `ß` is one example; final sigma `ς` gives the same split (`σοφος` is\r\n`xn--0xaajbq` for the connector and `xn--0xaakcn` for the hook). Characters that httpx's IDNA 2008\r\nencoder rejects (ZWJ/ZWNJ, compatibility forms such as `Ⅳ` or `fi`) cannot be used.\r\n\r\nSuggested fix: resolve and check the exact name the connection uses,\r\n`request.url.raw_host.decode(\"ascii\")` instead of `request.url.host`, and treat a resolution failure\r\nas a refusal unless a proxy is configured. Doing the check inside the transport (resolve once,\r\nconnect to the checked address) would also close the documented DNS-rebinding gap.\n\n### Proof of concept\n\nReproduction:\r\n\r\n1. In a DNS zone you control, create `fass.<zone>` with any public A record and\r\n   `xn--fa-hia.<zone>` with an internal A record (I used 127.0.0.1, standing in for an internal or\r\n   metadata endpoint). Optionally leave `fass.nx.<zone>` undefined and create\r\n   `xn--fa-hia.nx.<zone>` -> 127.0.0.1 to see the proxy-only branch reached without a proxy.\r\n2. Run an HTTP service on the internal address (I used a stub on 127.0.0.1:80 that returns a canary\r\n   JSON for `/latest/meta-data/...`).\r\n3. Start `mcp-server-fetch` 2026.10.10 as `python -m mcp_server_fetch` with no arguments (no\r\n   `--allow-private-ips`, no `--proxy-url`) and no relevant environment variables, so the guard is on.\r\n   Client: the MCP Python SDK 1.30.0 (`ClientSession.call_tool`) over stdio.\r\n4. Call the `fetch` tool with `http://xn--fa-hia.<zone>/latest/meta-data/...` (or the Unicode form\r\n   `http://faß.<zone>/...`). The internal service's response comes back as the tool result.\r\n   The same request with a plain name resolving to 127.0.0.1, or with `http://127.0.0.1/...`, is\r\n   refused by the guard.\r\n\r\nMy run, in one disposable `python:3.12-slim` container with a toy DNS server on 127.0.0.1:53 and the\r\nstub on 127.0.0.1:80 (nothing outside the container contacted after installing the package).\r\nVersions: Python 3.12.15, mcp-server-fetch 2026.10.10, httpx 0.28.1, idna 3.20, mcp 1.30.0. The real\r\nserver was driven over stdio with the MCP Python client, calling `fetch` with `raw: true`:\r\n\r\n| URL | Result |\r\n|---|---|\r\n| `http://127.0.0.1/latest/meta-data/...` | refused: \"127.0.0.1 resolves to 127.0.0.1, which is not a public address\" |\r\n| `http://direct.attacker.test/latest/meta-data/...` | refused (resolves to 127.0.0.1) |\r\n| `http://xn--fa-hia.attacker.test/latest/meta-data/...` | **returned the internal service's response** (`{\"AccessKeyId\": \"ASIA-POC-CANARY\", ...}`) |\r\n| `http://faß.attacker.test/latest/meta-data/...` | **returned the internal response** |\r\n| `http://xn--fa-hia.nx.attacker.test/latest/meta-data/...` | **returned the internal response** (hook lookup NXDOMAIN; the server itself resolved and connected to the IDNA 2008 name, no proxy) |\r\n\r\nThe internal service logged the requests with `Host: xn--fa-hia.attacker.test` and\r\n`Host: xn--fa-hia.nx.attacker.test`, including the robots.txt check, which takes the same path.\r\n\r\nRoot cause in three lines:\r\n\r\n```python\r\nimport httpx\r\nu = httpx.URL(\"http://xn--fa-hia.attacker.test/\")\r\nprint(u.host, u.raw_host, u.host.encode(\"idna\"))\r\n# faß.attacker.test b'xn--fa-hia.attacker.test' b'fass.attacker.test'\r\n```\r\n\r\nI can share the full container script (DNS server, stub service, MCP client) if it helps.\r\n\n\n### Impact\n\nServer-side request forgery (CWE-918) through a bypass of the default egress guard. Affected: anyone\r\nrunning `mcp-server-fetch` 2026.10.10 with default settings, typically as a tool for an AI agent. The\r\nguard exists to stop a model-supplied URL, for example one planted by prompt injection in fetched\r\ncontent, from reaching loopback services, RFC 1918 hosts and cloud metadata endpoints from the\r\nmachine running the server. With this bypass an attacker who controls any domain gets that access\r\nback, and the response is returned to the model, so it can be read or passed on.\r\n\r\nLimits: the attacker needs the model to fetch an attacker URL (prompt injection or a user request);\r\nwhat is reachable depends on where the server runs; I tested a loopback service standing in for a\r\nmetadata endpoint.","summary":"The mcp-server-fetch private-address check resolves a different hostname than the one httpx connects to for internationalized domain names. An attacker who controls a domain can make the server reach loopback, private-network or cloud-metadata endpoints and return the response to the model.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcp-server-fetch","fixed":["2026.10.24"],"affected":">= 2026.10.10, <= 2026.10.19","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-agents","ai-tooling","cwe-918","mcp","python","self-hosted"],"not_affected_if":["fetch-tool-unused","fixed-version","no-internal-services"],"how_to_check":"- Run `pip show mcp-server-fetch` and confirm the version is `2026.10.10` through `2026.10.19`.\n- Check whether the fetch tool is exposed to a model that may fetch attacker-supplied URLs.","fix":"- `mcp-server-fetch` `2026.10.24`","status":"open","published_at":"2026-10-25T00:19:06+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:55:05+00:00","updated_at":"2026-11-09T22:55:05+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T22:55:05Z","model":"claude-haiku-5-5","output":{"fix":"- `mcp-server-fetch` `2026.10.24`","reach":"internet","title":"mcp-server-fetch: IDNA hostnames bypass private-address guard, reaching internal services","impact":"medium","summary":"The mcp-server-fetch private-address check resolves a different hostname than the one httpx connects to for internationalized domain names. An attacker who controls a domain can make the server reach loopback, private-network or cloud-metadata endpoints and return the response to the model.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","python","ai-agents","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"internal service responses, including cloud metadata, returned to the model","analyst_note":"","how_to_check":"- Run `pip show mcp-server-fetch` and confirm the version is `2026.10.10` through `2026.10.19`.\n- Check whether the fetch tool is exposed to a model that may fetch attacker-supplied URLs.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-internal-services","fetch-tool-unused"],"who_is_affected":"Any system running mcp-server-fetch 2026.10.10 through 2026.10.19 with default settings, typically as a fetch tool for an AI agent, is exposed. The guard only matters where the server runs on a machine with internal services or cloud metadata endpoints. Systems on another version, or where the fetch tool is not reachable by a model that might read attacker-controlled URLs, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.001026,"input_tokens":7316,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0':558C,565C '-104120':234C '-2026':233C '-918':37B '/latest/meta-data':721C '1':644C '127.0.0.1':670C,687C,713C '2':699C '2003':129C,395C,488C '2008':140C,352C,503C,575C '2026.10.10':105C,206C,272C '3':722C '3.1':196C '4.0':191C '5033':224C '6.3':192C '6d613ecff7d320e0e0414a997f46bc4b3367c50d':330C '7.4':199C '80':714C 'add':99C,207C 'address':4A,50B,97C,162C,188C,220C,256C,287C,415C,437C,630C,707C 'agent':32B 'ai':31B,34B 'ai-ag':30B 'ai-tool':33B 'also':457C,632C 'answer':430C 'anyon':146C 'appli':519C 'approv':427C 'ascii':601C 'attack':67B 'attacker.example':377C 'becom':132C 'branch':464C,694C 'built':388C 'built-in':387C 'bypass':6A 'c003d0d807409b22fa640d1f8e11f38f15755721':267C 'canari':718C 'cannot':308C,586C 'charact':570C 'check':10A,51B,106C,300C,471C,497C,593C,620C,629C 'close':633C 'cloud':83B,171C,218C,289C 'cloud-metadata':82B,170C 'code':273C 'codec':391C 'compat':579C 'concept':642C 'configur':181C,512C,617C 'connect':12A,60B,114C,136C,303C,343C,360C,433C,507C,598C,626C 'connector':562C 'control':69B,148C,650C 'cover':516C 'cpython':378C 'creat':651C,684C 'cve':232C 'cvss':190C,195C 'cwe':36B 'decod':373C 'default':180C,222C,280C 'destin':244C 'detail':201C 'develop':326C 'differ':14A,54B,108C,345C 'direct':508C 'dns':296C,451C,637C,647C 'dns-rebind':450C,636C 'document':449C,460C,635C 'domain':64B,71B,150C,408C 'e.g':356C 'encod':353C,381C,576C 'endpoint':85B,173C,291C,678C 'equival':197C 'everi':532C 'exact':595C 'exampl':547C 'exist':492C 'fa':144C,419C,661C 'fa-hia':143C,418C,660C 'fa-hia.attacker.example':358C 'fa-hia.nx':686C 'fail':477C 'failur':609C 'fass':133C,411C,652C 'fass.attacker.example':406C 'fass.nx':681C 'faß':131C,376C 'fetch':1A,29A,47B,104C,176C,205C,275C,528C 'final':548C 'fix':226C,514C,590C 'form':130C,141C,375C,580C 'gap':639C 'getaddrinfo':249C,370C 'ghsa':17A,22A 'ghsa-v38p-wf49-hx2j':16A,21A 'give':551C 'go':539C 'guard':5A,98C,125C,209C,236C 'hia':145C,420C,662C 'high':200C 'hook':241C,340C,367C,403C,426C,474C,494C,543C,569C 'hop':534C 'host':42B,123C,350C,355C 'hostnam':9A,55B,109C,305C,338C 'http':702C 'httpx':59B,113C,135C,239C,347C,432C,499C,572C 'hx2j':20A,25A 'idna':8A,122C,128C,139C,351C,390C,394C,487C,502C,574C 'includ':288C 'insid':621C 'instead':602C 'intern':161C,423C,436C,665C,675C,706C 'internation':63B,121C,337C 'involv':442C 'issu':316C 'json':719C 'l119':262C 'l119-l143':261C 'l130':466C 'l130-l133':465C 'l133':467C 'l140':333C 'l140-l154':332C 'l143':263C 'l154':334C 'leav':680C 'limit':295C,453C 'line':327C 'link':215C 'link-loc':214C 'list':293C 'local':216C 'look':404C 'lookup':476C 'loopback':77B,165C,212C 'make':73B 'map':397C 'mcp':27A,38B,45B,102C,203C 'mcp-server-fetch':26A,44B,101C,202C 'medium':193C 'metadata':84B,172C,219C,290C,677C 'mismatch':456C 'model':92B,524C 'name':15A,65B,155C,314C,346C,363C,384C,480C,489C,504C,596C 'neither':319C 'network':80B,168C 'non':285C 'non-publ':284C 'one':58B,112C,424C,546C 'option':679C 'owner':409C 'pass':368C,525C 'point':152C,410C 'pr':223C 'present':323C 'privat':3A,49B,79B,96C,167C,213C,243C 'private-address':2A,48B,95C 'private-network':78B,166C 'proof':640C 'proxi':312C,462C,511C,615C,692C,698C 'proxy-on':311C,461C,691C 'public':158C,259C,286C,414C,429C,655C 'publish':271C 'python':39B 'reach':76B,164C,458C,695C 'readm':184C,276C 'rebind':297C,452C,638C 'record':657C,667C 'redirect':533C 'refus':186C,211C,242C,251C,283C,612C 'reject':577C 'reproduct':643C 'request':240C,253C 'request.url.host':247C,604C 'request.url.raw_host.decode':600C 'resolut':608C 'resolv':13A,52B,126C,246C,309C,344C,484C,500C,591C,624C 'respons':89B 'return':87B,716C 'run':700C 'say':185C 'see':689C 'self':41B 'self-host':40B 'separ':446C 'server':28A,46B,75B,103C,204C,282C,307C,482C 'server.py':331C 'servic':703C 'sever':189C 'sigma':549C 'sinc':535C 'skip':469C,495C 'socket.getaddrinfo':380C 'split':554C 'src/fetch/src/mcp_server_fetch/server.py':260C 'ss':400C 'ssrf':229C 'stand':671C 'state':277C 'still':322C 'store':348C 'stub':711C 'suggest':589C 'summari':93C 'tag':265C 'time':441C 'tool':35B,177C,529C 'track':230C 'transport':623C 'treat':606C 'two':154C,294C 'undefin':682C 'unicod':374C,383C 'unless':613C 'url':118C,522C 'url.host':364C 'url.raw':354C 'use':588C,599C,669C,709C 'v1.0.0':266C 'v2/main':328C 'v38p':18A,23A 'via':7A 'wf49':19A,24A 'without':696C 'would':631C 'xaajbq':559C 'xaakcn':566C 'xn':142C,357C,417C,557C,564C,659C,685C 'zone':648C 'zwj/zwnj':578C 'ß':398C,544C 'ς':550C 'σοφος':555C 'ⅳ':583C 'fi':585C","nicknames":[],"mitigations":[],"who_affected":"Any system running mcp-server-fetch 2026.10.10 through 2026.10.19 with default settings, typically as a fetch tool for an AI agent, is exposed. The guard only matters where the server runs on a machine with internal services or cloud metadata endpoints. Systems on another version, or where the fetch tool is not reachable by a model that might read attacker-controlled URLs, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mcpserverfetch"],"ptokens":["fetch","mcp","server"],"labels":["aiagents","aitooling","cwe918","mcp","medium","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'address':4A 'bypass':6A 'check':10A 'connect':12A 'differ':14A 'fetch':1A,29A 'ghsa':17A,22A 'ghsa-v38p-wf49-hx2j':16A,21A 'guard':5A 'hostnam':9A 'hx2j':20A,25A 'idna':8A 'mcp':27A 'mcp-server-fetch':26A 'name':15A 'privat':3A 'private-address':2A 'resolv':13A 'server':28A 'v38p':18A,23A 'via':7A 'wf49':19A,24A","search_b":"'-918':37B 'address':50B 'agent':32B 'ai':31B,34B 'ai-ag':30B 'ai-tool':33B 'attack':67B 'check':51B 'cloud':83B 'cloud-metadata':82B 'connect':60B 'control':69B 'cwe':36B 'differ':54B 'domain':64B,71B 'endpoint':85B 'fetch':47B 'host':42B 'hostnam':55B 'httpx':59B 'internation':63B 'loopback':77B 'make':73B 'mcp':38B,45B 'mcp-server-fetch':44B 'metadata':84B 'model':92B 'name':65B 'network':80B 'one':58B 'privat':49B,79B 'private-address':48B 'private-network':78B 'python':39B 'reach':76B 'resolv':52B 'respons':89B 'return':87B 'self':41B 'self-host':40B 'server':46B,75B 'tool':35B","search_c":"'-0':558C,565C '-104120':234C '-2026':233C '/latest/meta-data':721C '1':644C '127.0.0.1':670C,687C,713C '2':699C '2003':129C,395C,488C '2008':140C,352C,503C,575C '2026.10.10':105C,206C,272C '3':722C '3.1':196C '4.0':191C '5033':224C '6.3':192C '6d613ecff7d320e0e0414a997f46bc4b3367c50d':330C '7.4':199C '80':714C 'add':99C,207C 'address':97C,162C,188C,220C,256C,287C,415C,437C,630C,707C 'also':457C,632C 'answer':430C 'anyon':146C 'appli':519C 'approv':427C 'ascii':601C 'attacker.example':377C 'becom':132C 'branch':464C,694C 'built':388C 'built-in':387C 'c003d0d807409b22fa640d1f8e11f38f15755721':267C 'canari':718C 'cannot':308C,586C 'charact':570C 'check':106C,300C,471C,497C,593C,620C,629C 'close':633C 'cloud':171C,218C,289C 'cloud-metadata':170C 'code':273C 'codec':391C 'compat':579C 'concept':642C 'configur':181C,512C,617C 'connect':114C,136C,303C,343C,360C,433C,507C,598C,626C 'connector':562C 'control':148C,650C 'cover':516C 'cpython':378C 'creat':651C,684C 'cve':232C 'cvss':190C,195C 'decod':373C 'default':180C,222C,280C 'destin':244C 'detail':201C 'develop':326C 'differ':108C,345C 'direct':508C 'dns':296C,451C,637C,647C 'dns-rebind':450C,636C 'document':449C,460C,635C 'domain':150C,408C 'e.g':356C 'encod':353C,381C,576C 'endpoint':173C,291C,678C 'equival':197C 'everi':532C 'exact':595C 'exampl':547C 'exist':492C 'fa':144C,419C,661C 'fa-hia':143C,418C,660C 'fa-hia.attacker.example':358C 'fa-hia.nx':686C 'fail':477C 'failur':609C 'fass':133C,411C,652C 'fass.attacker.example':406C 'fass.nx':681C 'faß':131C,376C 'fetch':104C,176C,205C,275C,528C 'final':548C 'fix':226C,514C,590C 'form':130C,141C,375C,580C 'gap':639C 'getaddrinfo':249C,370C 'give':551C 'go':539C 'guard':98C,125C,209C,236C 'hia':145C,420C,662C 'high':200C 'hook':241C,340C,367C,403C,426C,474C,494C,543C,569C 'hop':534C 'host':123C,350C,355C 'hostnam':109C,305C,338C 'http':702C 'httpx':113C,135C,239C,347C,432C,499C,572C 'idna':122C,128C,139C,351C,390C,394C,487C,502C,574C 'includ':288C 'insid':621C 'instead':602C 'intern':161C,423C,436C,665C,675C,706C 'internation':121C,337C 'involv':442C 'issu':316C 'json':719C 'l119':262C 'l119-l143':261C 'l130':466C 'l130-l133':465C 'l133':467C 'l140':333C 'l140-l154':332C 'l143':263C 'l154':334C 'leav':680C 'limit':295C,453C 'line':327C 'link':215C 'link-loc':214C 'list':293C 'local':216C 'look':404C 'lookup':476C 'loopback':165C,212C 'map':397C 'mcp':102C,203C 'mcp-server-fetch':101C,202C 'medium':193C 'metadata':172C,219C,290C,677C 'mismatch':456C 'model':524C 'name':155C,314C,346C,363C,384C,480C,489C,504C,596C 'neither':319C 'network':168C 'non':285C 'non-publ':284C 'one':112C,424C,546C 'option':679C 'owner':409C 'pass':368C,525C 'point':152C,410C 'pr':223C 'present':323C 'privat':96C,167C,213C,243C 'private-address':95C 'private-network':166C 'proof':640C 'proxi':312C,462C,511C,615C,692C,698C 'proxy-on':311C,461C,691C 'public':158C,259C,286C,414C,429C,655C 'publish':271C 'reach':164C,458C,695C 'readm':184C,276C 'rebind':297C,452C,638C 'record':657C,667C 'redirect':533C 'refus':186C,211C,242C,251C,283C,612C 'reject':577C 'reproduct':643C 'request':240C,253C 'request.url.host':247C,604C 'request.url.raw_host.decode':600C 'resolut':608C 'resolv':126C,246C,309C,344C,484C,500C,591C,624C 'return':716C 'run':700C 'say':185C 'see':689C 'separ':446C 'server':103C,204C,282C,307C,482C 'server.py':331C 'servic':703C 'sever':189C 'sigma':549C 'sinc':535C 'skip':469C,495C 'socket.getaddrinfo':380C 'split':554C 'src/fetch/src/mcp_server_fetch/server.py':260C 'ss':400C 'ssrf':229C 'stand':671C 'state':277C 'still':322C 'store':348C 'stub':711C 'suggest':589C 'summari':93C 'tag':265C 'time':441C 'tool':177C,529C 'track':230C 'transport':623C 'treat':606C 'two':154C,294C 'undefin':682C 'unicod':374C,383C 'unless':613C 'url':118C,522C 'url.host':364C 'url.raw':354C 'use':588C,599C,669C,709C 'v1.0.0':266C 'v2/main':328C 'without':696C 'would':631C 'xaajbq':559C 'xaakcn':566C 'xn':142C,357C,417C,557C,564C,659C,685C 'zone':648C 'zwj/zwnj':578C 'ß':398C,544C 'ς':550C 'σοφος':555C 'ⅳ':583C 'fi':585C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-25T00:19:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-v38p-wf49-hx2j","url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-v38p-wf49-hx2j","severity":"medium","published_at":"2026-10-25T00:19:06+00:00","modified_at":"2026-10-25T00:19:07+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110619,"url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-v38p-wf49-hx2j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}