# SSRF via unfiltered fetch adapters

URL-accepting fetch helpers or adapters that skip scheme, private-IP, redirect, or header limits

_Area: Web infrastructure and server-side requests. Seen in 4 disclosed reports; latest 2026-09-30. Updated 2026-10-24._

## How it works
A server-side fetch helper accepts a URL (or a URL plus headers) from a caller and hands it to an HTTP client without enforcing the safety properties the surrounding code assumes. The assumption that breaks: that the transport enforces the documented guard. In practice each adapter, SDK client, or tool wrapper applies its own defaults, and a security option set in one path is silently dropped in another. The Fetch API default `redirect: 'follow'` applies when no `redirect` key is built [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md); a Pydantic model types `url` as bare `str` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md); a tool argument flows straight into `httpx.AsyncClient(follow_redirects=True).get()` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md). The request then reaches internal hosts, cloud metadata, or state-changing endpoints.

## Where it shows up
- Multiple adapters/transports for the same client; only some read the security config [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md)
- Config destructuring that omits `maxRedirects`, or fetch options built without a `redirect` key [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md)
- Request models with `url: str` and no scheme/private-IP/allowlist check [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md)
- User-supplied `headers` dict forwarded to an SDK client [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md)
- Tool signatures taking a URL argument passed unsanitized to httpx/requests [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md)
- `follow_redirects=True` on a fetch of caller-controlled input [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md)
- Auth middleware that checks token non-emptiness only, or validates credentials after the fetch [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md)

## How to review
Trace the URL from the request model or tool signature to every network sink. The invariant: before any outbound request, the resolved URL must be checked for allowed scheme, non-private/non-metadata IP (including after DNS resolution and after each redirect), and redirect count must be capped by the code path actually used. Grep for `urlparse`, `ipaddress`, allowlists; absence is a signal. For multi-adapter libraries, diff each adapter's config destructuring against the documented security options [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md). For SDK proxying, check whether a headers dict is also forwarded [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md). Check whether auth runs before the tool body executes [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md).

## Variants seen
- Redirect-based SSRF: `maxRedirects: 0` ignored by fetch adapter [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md)
- Blind SSRF with attacker-controlled Authorization/Cookie headers via MCP transports [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md)
- Unauthenticated tool-argument SSRF to internal hosts and cloud metadata [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md)

## Impact and severity
Leaked internal responses, hits to state-changing endpoints [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md), authenticated write primitives against internal services via forwarded headers [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md), and cloud metadata access [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md). Severity rises with unauthenticated reachability, header forwarding, and redirect following.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-r4gj-5m52-g5wh.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-hvfh-5mj3-5f3j.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-45gf-fjxp-cjpq.md