MCP Fetch private-address guard resolved a different hostname than HTTPX

The Fetch server checked one string under Python hostname normalization and let HTTPX connect using a different IDNA interpretation. The two domain spellings were not interchangeable, yet the result of the first lookup authorized the second request. primary evidence shows how an agent fetch operation can cross from public web content to an internal endpoint without time-based DNS rebinding.

The proof reached a local stand-in service, not a verified production metadata credential. The defender must be persuaded or instructed to fetch a crafted URL, and reachable internal destinations depend on deployment.

Resolve, authorize and connect against one pinned network endpoint; repeat checks across redirects. The patched Fetch version cited in the disclosure should be installed rather than relying on apparent URL normalization.

The mismatch is deterministic and must not be mislabeled DNS rebinding. Python's IDNA2003 conversion can treat a name containing ß as ss, while HTTPX uses the IDNA2008 punycode form. A public address checked under the first hostname can therefore authorize a private target reached by the second. The disclosure demonstrated a loopback service rather than credential theft. Fetch 2026.10.24 corrects the affected range 2026.10.10 through 2026.10.19. Destination checks must use the final address the socket actually connects to, including after redirects.