mcp-remote CVE-2026-108716

Exploitation requires THREE concrete conditions to coincide: (1) the target MCP/OAuth server's discovered device-authorization and token endpoints must be non-loopback http (cleartext) URLs - mcp-remote fails to enforce HTTPS in authorizeWithDeviceCode; (2) the attacker must occupy an on-path/man-in-the-middle network position to observe that traffic; and (3) the victim must actively initiate the device-code OAuth grant (passive user interaction) so that the client secret is transmitted. Limiting factors: loopback (localhost) endpoints and any server correctly using https are not vulnerable, and the attacker gains nothing without both the MITM vantage point and a live auth flow - this is not exploitable against a server configured with HTTPS endpoints.

This is a genuine but moderate-priority confidentiality flaw, correctly rated Medium (CVSS 4.0 base 6.0). The provided vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N) tells a consistent story: network-reachable and unauthenticated (PR:N), but gated by two real-world dampeners - AT:P (a specific attack requirement, i.e. the attacker must hold an on-path/MITM position AND the OAuth server must advertise non-loopback http endpoints) and UI:P (passive user interaction, the victim must initiate the device-code auth flow). High confidentiality impact (VC:H) is justified because client secrets plus access and refresh tokens are exposed, but there is no direct integrity or availability impact (VI:N/VA:N). No EPSS score, KEV listing, or confirmed POC was provided: exploitation requires both a privileged network vantage point and a misconfigured/plaintext authorization server, which argues against broad opportunistic exploitation. A public technical write-up (hackmd) and a VulnCheck advisory exist, raising the chance of a working PoC, but no exploit code is confirmed in the input. Net: a real defect worth patching, especially for anyone running mcp-remote against OAuth servers reachable over untrusted networks, but not an emergency relative to CVSS-high network-RCE issues.

A victim runs mcp-remote (0.8.0-0.14.3) to connect to a remote MCP server whose discovered device-authorization or token endpoint is a non-loopback http (cleartext) URL. An attacker positioned on the network path - e.g. on shared Wi-Fi or via ARP/DNS spoofing - passively captures the device-code exchange as the user authenticates, harvesting the client secret and the issued access and refresh tokens. No public weaponized exploit is confirmed, though a technical write-up detailing the flaw is publicly available.