The Reference Implementation Needed a Security Release: Eight Fixes Across MCP Filesystem, Everything, and Fetch

2026-10-29 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 25 October 2026 at 00:03 UTC, the reference MCP servers repository (modelcontextprotocol/servers) shipped security release v2.1.0: eight vulnerabilities in three servers, with the upgrade targets spelled out plainly — @modelcontextprotocol/server-filesystem and @modelcontextprotocol/server-everything to 2.0.1, mcp-server-fetch to 2026.10.24. We read the release notes first-hand. This one matters beyond its own eight because these are the servers everyone copies: the filesystem server is the template every tutorial forks, the fetch server is the default web-retrieval tool, and the patterns it got wrong — check-then-use on paths, one hostname checked while another is dialled, a wildcard origin on a tool endpoint — are the patterns a thousand downstream servers inherited. If you run any of the three, upgrade; if you forked any of them, audit the fork against the same list.

Filesystem: four ways out of the allowed directory

Four of the eight fixes land in @modelcontextprotocol/server-filesystem 2.0.1 (affected: 1.0.0 through 2.0.0, plus date versions through 2026.8.31), and all four are the same failure wearing different clothes: the path that was checked is not the path that was used.

The sharpest is the time-of-check-to-time-of-use on writes (GHSA-53mr-w429-c597). On Linux and macOS, a parent directory swapped for a symlink between the access check and the write can now no longer redirect write_file, edit_file, create_directory, or the move_file destination outside the allowed directories — writes stay inside the directory that was actually checked. Note the platform caveat the advisory carries rather than hides: on Windows this is only partly fixed, with the advisory documenting what remains exposed and how to configure around it. If your agent fleet is mixed-OS, the Windows hosts need the workaround, not just the version bump.

The other three are quieter and arguably more instructive. The access check used to strip a trailing quote or whitespace that the underlying file operation keeps, so a sibling directory named after an allowed one with that suffix passed the check while the operation landed next door (GHSA-7rgq-gccq-qphx) — paths are now compared exactly as they are used. A symlink spelled in different letter case slipped past the symlink check for new paths on case-insensitive volumes such as macOS’s default, a regression introduced in 2026.8.31 (GHSA-4gxg-m5jx-9j57). And list_directory_with_sizes now checks each entry before reading its size, closing a hole where a symlink inside an allowed directory disclosed the size and modification time of a file outside it (GHSA-hhwq-wxfx-cj7g) — a metadata oracle of the kind earlier filesystem-server research has repeatedly shown to be enough for targeted exfiltration staging.

Everything: your tool server answered any web page

@modelcontextprotocol/server-everything 2.0.1 (affected: 1.0.0 through 2.0.0, plus date versions 2025.9.24 through 2026.8.31) fixes the one that should worry every team exposing an MCP HTTP transport: the HTTP and SSE transports refused requests from other web origins only after this release. Before it, the server sent Access-Control-Allow-Origin: * and performed no origin check, so a web page the user merely visited could call the server’s tools — the release notes name get-env — and read the results. The fix checks the Origin header and drops the wildcard. One advisory, GHSA-mvf5-2qqv-rg3c, but it converts every browser on the network into a potential caller of tools that were never meant to face the web. This is the same trust-boundary confusion as the October MCP SDK batch, and it sits one rung lower in the stack — in the transport everyone scaffolds from.

Fetch: checked one name, dialled another

mcp-server-fetch 2026.10.24 (affected: everything through 2026.10.19) collects the remaining three, and all three are SSRF plumbing. For internationalised hostnames the server checked one form of the name and connected to another, so a crafted IDNA name could reach an internal address (GHSA-v38p-wf49-hx2j). NAT64 addresses are now judged by the IPv4 address they carry: anything in 64:ff9b::/96 wrapping a private, loopback, or link-local IPv4 address is refused, as IPv4-mapped addresses already were (GHSA-66qx-2266-pmj6) — the kind of encoding-differential bypass that keeps recurring because each new address representation reopens a denylist written for the old ones. And robots.txt is checked again after every redirect rather than only for the first URL requested (GHSA-3jqg-r5pp-rmp2), closing the redirect-laundering path around the one fetch control site operators actually rely on.

The upgrade gotcha that will leave fleets exposed

Read the release notes’ upgrading paragraph twice, because it predicts the long tail of this batch. The TypeScript servers moved from date versions (2025.x, 2026.x) to semantic versions at 1.0.0 — and package managers rank 2.0.1 below every 2025.x and 2026.x version, so they will not offer it as an upgrade. If you are on a date version, nothing will prompt you; install 2.0.1 explicitly (npm install @modelcontextprotocol/server-filesystem@2.0.1). This is the same versioning trap that has kept silent MCP flaws deployed months after their fixes: the fix exists, the fleet never hears about it. Inventory your pinned MCP server versions the way you would any other dependency — scanners keyed on semver ranges will misread date-versioned installs — and treat forks of these three servers as carrying all eight until proven otherwise.

What to do

Upgrade the three servers now: filesystem and everything to 2.0.1, fetch to 2026.10.24. Date-versioned installs need an explicit install, not an upgrade command.
Apply the Windows filesystem workaround from GHSA-53mr-w429-c597 on any Windows host — the TOCTOU fix is partial there by the advisory’s own account.
Audit forks and vendored copies of the filesystem, everything, and fetch servers against the eight GHSA entries; the reference code is the most-copied MCP code in existence.
Check every MCP HTTP/SSE transport you expose for the Everything pattern: wildcard CORS plus tools that can read the environment is remote tool invocation by drive-by visit.

Our write-up is analysis of the v2.1.0 GitHub release notes for modelcontextprotocol/servers (published 25 October 2026 00:03 UTC), read first-hand in full, including the affected and fixed version ranges, the eight GHSA identifiers, and the date-version upgrade caveat. All verification was read-only: we installed, ran, and exploited no MCP server, sent no cross-origin or redirect-laundering request, and contacted no maintainer. Advisory-level details beyond the release notes are carried as the release notes state them.

Sources: