Skip to content
OpenAdvisories
Critical · 9.4 Scanner template Public exploit CVE-2025-49596 EUVD-2025-20870GHSA-7f8r-222p-6f5g

MCP Inspector proxy server lacks authentication between the Inspector client and proxy

Published Jun 13, 2025 · Updated Jul 9, 2025 · Assigned by GitHub_M

Vendor: Model Context Protocol Product: inspector Package: @modelcontextprotocol/inspector Ecosystem: npm

Description

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.

Affected products

VendorProductAffectedFixed
modelcontextprotocol inspector < 0.14.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

  • RajSidwadkar/UAP-protocol ★ 1 · Jun 6, 2026

    A unified, security-first wire protocol for tool access and agent coordination. UAP eliminates CVE-2025-49596 and MCP tool-poisoning vulnerabilities using Ed25519-signed CapabilityCards, mandatory mT…

  • acseguin21/trust-boundary-ctf ★ 0 · Apr 10, 2026

    Browser-based MCP CTF — OAuth token confusion and session isolation failure (CVE-2025-49596 pattern). DevTools only.

  • pppxo/CVE-2025-49596-PoC ★ 0 · Mar 25, 2026

    PoC for CVE-2025-49596 on linux targets

  • ashiqrehan-21/MCP-Inspector-CVE-2025-49596 ★ 0 · Jul 3, 2025

    MCP-Inspector-vulncheck is a Python script that checks if an MCP Inspector server is vulnerable to CVE-2025-49596. It tests whether the /sse endpoint responds to unauthenticated requests, indicating …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
npm @modelcontextprotocol/inspector < 0.14.1 0.14.1 GHSA-7f8r-222p-6f5g

References