MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Priority HIGH 72CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.44453 98th percentileScored 2026-11-07
Fix Fixed inspector (modelcontextprotocol): 0.14.1@modelcontextprotocol/inspector (npm): 0.14.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | inspector | before 0.14.1 | 0.14.1 | Patch available | CNA |
| — | @modelcontextprotocol/inspector (npm) | before 0.14.1 | 0.14.1 | Patch available | GHSA-7f8r-222p-6f5g |
- inspector VendorMLflow Affected before 0.14.1 Fixed in 0.14.1 Patch available CNA
- @modelcontextprotocol/inspector (npm) Vendor— Affected before 0.14.1 Fixed in 0.14.1 Patch available GHSA-7f8r-222p-6f5g
Remediation
- Fix · CNA inspector (modelcontextprotocol) Fixed in 0.14.1
- Fix · GHSA-7f8r-222p-6f5g @modelcontextprotocol/inspector (npm) Fixed in 0.14.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49596
- 2026-10-03 Alias added: GHSA-7f8r-222p-6f5g
References
Other 5
- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g
- https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979
- https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis
- https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
- https://github.com/modelcontextprotocol/inspector
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-49596 · CVE Program
- CVE-2025-49596 · NVD
- FIRST EPSS
- GHSA-7f8r-222p-6f5g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences