CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in the URL validation function of the jae-jae fetcher-mcp up to version 0.3.9, allowing remote attackers to manipulate requests to unauthorized endpoints. This could lead to unauthorized access to sensitive data or services within the affected environment. Organizations using this component should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_url/fetch_urls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.