All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-74858
MEDIUMpublished 2026-08-17 16:17 UTC · 17 hours ago
5.3
CVSS / 10
// description
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.
// weaknesses (CWE)
- CWE-918