Agentic WeeklyGet the weekly

MCP reference servers v2.1.0 fixes eight vulnerabilities in filesystem, everything and fetch

Release Ruler for this brief: marked at its publication date, Oct 26, 2026, among the AI models we track.

If you run the reference filesystem, everything or fetch MCP servers, update: v2.1.0 fixes eight vulnerabilities, and package managers will not offer the upgrade automatically to date-versioned installs.

By Agentic Weekly · Evidence: Reported · How we work

First seen
(via GitHub releases feed (watcher seed run))
Source published
(we saw it 27.8 hours later)
Brief published

What changed

  • Eight vulnerabilities are fixed across three servers: @modelcontextprotocol/server-filesystem 2.0.1 (four), @modelcontextprotocol/server-everything 2.0.1 (one) and mcp-server-fetch 2026.10.24 (three).
  • filesystem: writes now stay inside the directory that was checked on Linux and macOS, so a parent directory swapped for a symlink between the check and the write can no longer redirect them. On Windows the release says this is only partly fixed and points to advisory GHSA-53mr-w429-c597.
  • everything: the HTTP and SSE transports now check the Origin header and no longer send Access-Control-Allow-Origin: *, so a web page the user visits can no longer call the server's tools.
  • fetch: the address check and the connection now use the same host name for internationalized (IDNA) hosts, NAT64 addresses that wrap private IPv4 addresses are refused, and robots.txt is checked again after every redirect.
  • Upgrade note: installs on date versions (2025.x, 2026.x) will not see 2.0.1 as an upgrade. Install it explicitly, for example npm install @modelcontextprotocol/server-filesystem@2.0.1.
  • server-memory, server-sequential-thinking, mcp-server-git and mcp-server-time are unchanged in this release.

In the source’s words

“v2.1.0 fixes eight vulnerabilities in three servers.”

“Package managers rank 2.0.1 below every 2025.x and 2026.x version, so they won't offer it as an upgrade.”

Early verdict

Update the affected servers if you run them; the release's own table lists the affected versions.

Basis: Based only on the release notes' table of affected and fixed versions. We have not run the release or the advisories' reproductions.

What we have not verified

  • We did not run this release or try to reproduce any of the vulnerabilities.
  • We have not read the individual GitHub security advisories, so severity ratings and any CVE identifiers are not covered here.
  • How much of the Windows symlink exposure remains is described in the advisory, not here.

This brief is Reported: written from the sources below, not from running the release ourselves.

Sources

Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/mcp-servers-v2-1-0-security-fixes.md

Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.