Search
Find a vulnerability
Search criteria
2 vulnerabilities by jae-jae
CVE-2026-74858 (GCVE-0-2026-74858)
Vulnerability from nvd – Published: 2026-08-17 15:15 – Updated: 2026-08-18 13:37
VLAI
EPSS
VEX
Title
jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery
Summary
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:05 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391221 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391221/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-74858 | third-party-advisory |
| https://vuldb.com/submit/876015 | third-party-advisory |
| https://github.com/jae-jae/fetcher-mcp/issues/37 | broken-linkissue-tracking |
| https://github.com/jae-jae/fetcher-mcp/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jae-jae | fetcher-mcp |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 cpe:2.3:a:jae-jae:fetcher-mcp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:05:51.913208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:37:10.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jae-jae:fetcher-mcp:*:*:*:*:*:*:*:*"
],
"modules": [
"URL Validation"
],
"product": "fetcher-mcp",
"vendor": "jae-jae",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaobu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:15:16.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391221 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391221"
},
{
"name": "VDB-391221 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391221/cti"
},
{
"name": "CVE-2026-74858 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-74858"
},
{
"name": "Submit #876015 | jae-jae fetcher-mcp 0.3.9 non-blind SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/876015"
},
{
"tags": [
"broken-link",
"issue-tracking"
],
"url": "https://github.com/jae-jae/fetcher-mcp/issues/37"
},
{
"tags": [
"product"
],
"url": "https://github.com/jae-jae/fetcher-mcp/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-17T11:56:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-74858",
"datePublished": "2026-08-17T15:15:16.803Z",
"dateReserved": "2026-08-17T09:50:57.006Z",
"dateUpdated": "2026-08-18T13:37:10.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74858 (GCVE-0-2026-74858)
Vulnerability from cvelistv5 – Published: 2026-08-17 15:15 – Updated: 2026-08-18 13:37
VLAI
EPSS
VEX
Title
jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery
Summary
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:05 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391221 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391221/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-74858 | third-party-advisory |
| https://vuldb.com/submit/876015 | third-party-advisory |
| https://github.com/jae-jae/fetcher-mcp/issues/37 | broken-linkissue-tracking |
| https://github.com/jae-jae/fetcher-mcp/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jae-jae | fetcher-mcp |
Affected:
0.3.0
Affected: 0.3.1 Affected: 0.3.2 Affected: 0.3.3 Affected: 0.3.4 Affected: 0.3.5 Affected: 0.3.6 Affected: 0.3.7 Affected: 0.3.8 Affected: 0.3.9 cpe:2.3:a:jae-jae:fetcher-mcp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74858",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:05:51.913208Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:37:10.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jae-jae:fetcher-mcp:*:*:*:*:*:*:*:*"
],
"modules": [
"URL Validation"
],
"product": "fetcher-mcp",
"vendor": "jae-jae",
"versions": [
{
"status": "affected",
"version": "0.3.0"
},
{
"status": "affected",
"version": "0.3.1"
},
{
"status": "affected",
"version": "0.3.2"
},
{
"status": "affected",
"version": "0.3.3"
},
{
"status": "affected",
"version": "0.3.4"
},
{
"status": "affected",
"version": "0.3.5"
},
{
"status": "affected",
"version": "0.3.6"
},
{
"status": "affected",
"version": "0.3.7"
},
{
"status": "affected",
"version": "0.3.8"
},
{
"status": "affected",
"version": "0.3.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xiaobu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:15:16.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391221 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391221"
},
{
"name": "VDB-391221 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391221/cti"
},
{
"name": "CVE-2026-74858 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-74858"
},
{
"name": "Submit #876015 | jae-jae fetcher-mcp 0.3.9 non-blind SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/876015"
},
{
"tags": [
"broken-link",
"issue-tracking"
],
"url": "https://github.com/jae-jae/fetcher-mcp/issues/37"
},
{
"tags": [
"product"
],
"url": "https://github.com/jae-jae/fetcher-mcp/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-17T11:56:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-74858",
"datePublished": "2026-08-17T15:15:16.803Z",
"dateReserved": "2026-08-17T09:50:57.006Z",
"dateUpdated": "2026-08-18T13:37:10.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}