AI Threat Alert

auth-fetch MCP Vulnerabilities

npm AI Agents

AI Threat Alert tracks 2 known vulnerabilities in auth-fetch MCP — an AI/ML ai agents in the npm ecosystem. Each CVE includes CVSS severity, EPSS exploit probability, patch status, and CISO-grade analysis.

Data sources
2
Total CVEs
0
Critical
npm
Ecosystem
Jul 1, 2026
Last CVE
100%
Patch Rate
0d
Avg Time to Patch
30 stars 11 forks 0 issues Last push Jun 23, 2026
View on GitHub

Known Vulnerabilities (2 total, page 1 of 1)

Severity CVE ID Summary CVSS Published
HIGH CVE-2026-49857 auth-fetch-mcp: SSRF bypass via IPv6 loopback 7.4 Jul 1, 2026 HIGH GHSA-hv85-774v-26fg auth-fetch-mcp: SSRF + disk-exfil via unvalidated tool URLs 8.2 May 19, 2026

Frequently asked questions

What is auth-fetch MCP?

auth-fetch MCP is an AI/ML ai agents tracked by AI Threat Alert for security vulnerabilities in the npm ecosystem.

How many known vulnerabilities does auth-fetch MCP have?

auth-fetch MCP has 2 known CVEs, tracked from NVD and GitHub Advisory.

Which ecosystem is auth-fetch MCP distributed in?

auth-fetch MCP is distributed via the npm ecosystem and categorized as ai agents.

Where does the auth-fetch MCP vulnerability data come from?

Vulnerability data is sourced from NVD and GitHub Advisory, enriched with CVSS, EPSS, exploit signals, and patch status for each CVE.

How do I assess the risk of auth-fetch MCP?

Review each CVE below — every entry shows CVSS severity, EPSS exploit probability, exploitation signals, and whether a patched version is available.

Monitor auth-fetch MCP in your stack

Get instant alerts when new vulnerabilities affect auth-fetch MCP. CISO analysis, ATLAS technique mappings, and compliance reports included.

Start Monitoring