# CVE-2025-49596 MCP Inspector RCE: Chain and Fix

> Teardown of CVE-2025-49596: how a web page could reach the unauthenticated MCP Inspector proxy, the 0.14.1 fix, and what security teams should check.

Source: https://playciso.com/blog/cve-2025-49596-mcp-inspector-rce-chain-and-fix · Published: 2026-11-04 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g

---

**CVE-2025-49596** is a critical remote code execution vulnerability in **MCP Inspector**, the tool developers run to test and debug MCP servers. According to the project's own advisory, versions **below 0.14.1** had no authentication between the Inspector client and its proxy, so an unauthenticated request could make the proxy launch a command over stdio. The advisory was published on **13 June 2025**; the fixed version is **0.14.1**. If anyone on your team has ever run Inspector, find that copy and upgrade it. _This is a teardown of a vulnerability someone else found and the vendor already fixed. PlayCISO did not discover it and has not tested it. Facts are attributed to the record they come from and were checked on 4 November 2026. The chain is explained at a conceptual level only: no exploit code, payloads or proof-of-concept commands._ Confirmed vs not yet known **Confirmed by the advisory and NVD:** npm package `@modelcontextprotocol/inspector`, versions below 0.14.1, lack of authentication between client and proxy, remote code execution, fixed in 0.14.1, advisory GHSA-7f8r-222p-6f5g published 13 June 2025. **Score:** CVSS 4.0 base 9.4 Critical, from GitHub as CNA. NVD's status on its own record was "Deferred" when we fetched it and it shows no NVD-assigned score. **Reported by the discoverer (Oligo), not independently verified by us:** the browser-to-localhost route, the DNS rebinding variant and the existence of internet-exposed Inspector instances. **Not known:** whether anyone exploited it in the wild. We found no primary source that says so, and the NVD record has no CISA KEV fields. Who reported it first is also stated differently in different sources (see the timeline). ## What the weakness was MCP Inspector has two parts: a browser client and a small proxy. The proxy exists to start MCP servers on the developer's machine, usually as local child processes, and relay messages. Starting a process on request is the proxy's job, not a bug. The weakness, per the advisory, is that "the Inspector client and proxy do not authenticate each other", so anything that can send the proxy a request can ask it to start a command. The CNA classified it as CWE-306, missing authentication for a critical function. The tool was designed to run on a developer laptop and talk to localhost. That is why this belongs in a threat model even though it is "just a dev tool": it ran with the developer's rights, next to their source code, tokens and SSH keys. ## The attack chain, step by step (conceptual) The sequence below follows Oligo Security's write-up of the issue. It leaves out request details on purpose. - A developer starts Inspector locally. Oligo gives the mcp dev command as one way this happens, which starts the proxy in the background. - The proxy listens with no credential. Before 0.14.1 Oligo says there were "no session tokens or authorization". - The developer visits a hostile web page on an ordinary public domain. This is the single user action the CVSS vector calls "passive" interaction. - The page's JavaScript talks to the local proxy. Oligo describes two ways to get a public page to reach a local service: a browser behaviour around the 0.0.0.0 address, and a DNS rebinding variant that points a hostile DNS name at the local address. - The proxy accepts the request and starts an attacker-chosen command on the developer's machine, with the developer's privileges. Nothing in the chain needs a vulnerability in the MCP servers themselves. The missing check sits at the point where a request becomes a process. ## Impact, as reported - Advisory and NVD: remote code execution. The CNA's CVSS 4.0 vector rates confidentiality, integrity and availability impact as High for both the vulnerable system and subsequent systems. - Oligo: arbitrary code execution on the developer's machine, with possible data theft, backdoors, reverse shells and lateral movement. Oligo also says it found MCP Inspector instances exposed to the internet. The advisory does not describe real-world victims, and we are not aware of a primary source that does. ## The fix, exactly as documented - Upgrade to 0.14.1 or later. The advisory says users should do this immediately and lists no other workaround. - What 0.14.1 changes (from the fix commit 50df0e1, "Address inspector security vulnerabilities"): the proxy generates a random session token at startup and requires it as a Bearer token; the proxy binds to 127.0.0.1 by default (a HOST setting can override this, with a warning not to expose it to untrusted networks); the proxy validates the Origin header, with allowed origins defaulting to the client's port and extendable through ALLOWED_ORIGINS; the browser is no longer auto-opened when authentication is on. The commit also adds an environment variable, DANGEROUSLY_OMIT_AUTH, that turns authentication off. - Oligo's guidance: check the version globally with npm list -g and in project directories that install it under node_modules, keep authentication on, and keep host and origin checks in place. The 0.14.1 release notes on GitHub list only ordinary changes (sidebar, logging, linting) and do not mention security. Rely on the advisory and the commit, not the release notes, when you search for the fix. ## Timeline DateEventSource 26 Mar 2025Anthropic told Oligo that another researcher had reported the issue on this date.Oligo write-up 18 Apr 2025Oligo reports the vulnerabilities to Anthropic.Oligo write-up 13 Jun 2025GitHub advisory GHSA-7f8r-222p-6f5g published (credits Remy Marot); version 0.14.1 is the patched release; CVE record published in NVD.GitHub advisory; NVD 27 Jun 2025Oligo publishes its write-up of the chain and the fix.Oligo write-up 17 Jun 2026NVD record last modified (status "Deferred"; the only CVSS score is the CNA's 4.0 score of 9.4).NVD CVE API, fetched 4 Nov 2026 ## What security teams should check this week - Inventory every copy of MCP Inspector. Global installs, project dev dependencies, Dockerfiles, devcontainers, README run-instructions and CI jobs. Anything below 0.14.1 is affected per the advisory. - Search for DANGEROUSLY_OMIT_AUTH in scripts, compose files and shell profiles. The fix is only as good as leaving authentication on. - Look for a non-default HOST setting or any port-forward, tunnel or container port mapping that exposes the proxy beyond 127.0.0.1. Oligo reports finding exposed instances. - Treat local developer tools that spawn processes as in scope for your vulnerability programme. Add MCP tooling to the software inventory and the AI bill of materials, with versions. - Hunt for odd child processes started by node processes on developer machines. This is our suggestion, not something the advisory asks for: an Inspector-style tool launching a shell is a process-lineage alert worth having. - If an old copy was reachable and you cannot rule out a malicious page visit, treat the machine as potentially exposed and rotate the tokens and keys it holds. The advisory does not report any victims; this is a precaution. - Set a rule for MCP servers you test. Run unknown servers in a container or VM, not on the laptop that holds your cloud credentials. ## Why this matters beyond one tool A process-launching helper bound to localhost, with no credential, is a pattern, not a one-off. Browsers can be made to send requests to local services, so "it only listens locally" is not an access control. The three controls the 0.14.1 fix adds (a secret in each request, a loopback-only bind, an Origin check) are a reasonable baseline to ask of any local agent helper. Score your own tooling against the [MCP server security checklist](/tools/mcp-server-security-checklist), run your MCP config through the [MCP linter](/tools/mcp-linter), and rehearse what a proxy should refuse in the [MCP proxy policy lab](/tools/mcp-proxy-policy-lab). For the credentials a compromised helper could reach, see the [Agent Credential Broker Lab](/tools/agent-credential-broker-lab). To break down the vector yourself, use the [CVSS calculator](/tools/cvss-calculator), noting that CVSS 4.0 scores can differ from 3.1 for the same flaw. ## FAQ ### What is CVE-2025-49596? A remote code execution vulnerability in MCP Inspector, the developer tool for testing and debugging MCP servers. Per the NVD record and the project advisory, versions below 0.14.1 lack authentication between the Inspector client and its proxy, "allowing unauthenticated requests to launch MCP commands over stdio". ### Which MCP Inspector versions are affected and what is the fixed version? The advisory GHSA-7f8r-222p-6f5g lists the npm package @modelcontextprotocol/inspector, affected versions below 0.14.1, patched version 0.14.1. Both the advisory and the NVD record tell users to upgrade to 0.14.1 or later. ### What is the CVSS score of CVE-2025-49596? The only score on the NVD record is a CVSS 4.0 base score of 9.4 (Critical), supplied by GitHub as the CNA (source security-advisories@github.com), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. When we checked on 4 November 2026, NVD had not added a score of its own and its status was "Deferred". ### Is CVE-2025-49596 exploited in the wild? We found no primary source saying so. The NVD record we fetched carries no CISA Known Exploited Vulnerabilities fields. Oligo says it found MCP Inspector instances exposed to the internet, which is a statement about exposure, not about exploitation. Check the live KEV catalogue before relying on this answer. ### Does an attacker need network access to my machine to use this? According to the CVSS vector the CNA published, user interaction is "passive" and no privileges are required. Oligo describes the realistic route: a developer who runs Inspector locally visits a malicious web page, and that page makes requests to the local proxy. A DNS rebinding variant is also described. So the attacker needs the developer to browse, not a foothold on the network. ### What changed in MCP Inspector 0.14.1? The fix commit (50df0e1, "Address inspector security vulnerabilities") adds a random session token generated at startup and required as a Bearer token, a default bind to 127.0.0.1, and Origin header validation with an ALLOWED_ORIGINS setting. An environment variable named DANGEROUSLY_OMIT_AUTH turns authentication off. Oligo adds that Host and Origin checks were added. ### How do I check whether I have a vulnerable MCP Inspector? Oligo advises checking the installed version globally (npm list -g) and in each project that installs it under node_modules, and upgrading to 0.14.1 or later. Also look for any script, container or CI job that starts the Inspector, because those copies are easy to forget. ### Who discovered CVE-2025-49596? Sources differ. The advisory credits Remy Marot (listed with a Tenable address). Oligo Security says its researcher Avi Lumelsky reported the issue to Anthropic on 18 April 2025 and that Anthropic told Oligo another researcher had reported it on 26 March 2025. We have not tried to settle who was first. ### Is the browser 0.0.0.0 problem fixed? Oligo says the browser behaviour it relied on (called the "0.0.0.0-day") was still unpatched in major browsers as of 2025. The Inspector fix does not depend on the browser changing: it makes the proxy reject requests that do not carry the session token or come from an allowed origin. We have not verified the current state of any browser. ## Sources - GitHub Security Advisory GHSA-7f8r-222p-6f5g: Inspector proxy server vulnerabilities (modelcontextprotocol/inspector, published 13 June 2025; affected below 0.14.1, patched 0.14.1) - NVD record for CVE-2025-49596 (published 13 June 2025; CNA CVSS 4.0 score 9.4 from GitHub; CWE-306), read through the NVD CVE API on 4 November 2026 - Fix commit 50df0e1 in modelcontextprotocol/inspector (session token, loopback bind, Origin validation) - Oligo Security: Critical RCE vulnerability in Anthropic MCP Inspector (CVE-2025-49596) (27 June 2025; discoverer write-up) _This article is educational guidance for security and engineering leaders, not legal advice or a forensic report. It describes a published, fixed vulnerability at a defensive level. Check the advisory for the latest status before acting._