EUVD-2026-86018
GHSA-5wmf-76f4-cg47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim configures mcp-remote against attacker MCP server
-
DeliveryServer returns crafted authorization-server metadata
-
ExploitClient fetches attacker-specified internal URL
-
ExecutionInternal service response retrieved
-
ImpactSensitive internal data disclosed to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to run mcp-remote versions 0.1.32 through 0.1.38 and connect it to an attacker-controlled (or attacker-influenced) remote MCP server. During OAuth authorization-server metadata discovery (src/lib/authorization-server-metadata.ts and src/lib/utils.ts), the client trusts and fetches an attacker-supplied metadata/endpoint URL without adequate validation, enabling server-side requests to internal targets. Limiting factors: exploitation is client-side and depends on the user initiating a connection to a malicious server (effective user interaction), the impact is confined to confidentiality (information disclosure, no integrity or availability effect), and versions outside 0.1.32-0.1.38 are not affected. |
| Impact | The NVD 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) frames this as a network-reachable, unauthenticated, confidentiality-only SSRF/information-disclosure flaw in the mcp-remote OAuth client. In practice the risk is more moderate than the 7.5 suggests: exploitation is not against a listening service but against a client that must be pointed at an attacker-controlled MCP server, so a realistic vector requires the victim to initiate a connection (I assess UI:R, which NVD scored UI:N). No EPSS score, KEV entry, or explicit POC flag was supplied in the input; however, a dedicated third-party research repo (playb0t/mcp-remote-oauth-security) publishes a versioned technical advisory 'F-02-authorization-server-ssrf.md' describing this exact issue, so detailed exploitation methodology is public even if weaponized exploit code is not confirmed. No SSVC data was provided. Net: a genuine, patch-worthy SSRF in a security-sensitive OAuth bridge, but real-world urgency is tempered by the need to lure a victim into connecting to a malicious server and by the confidentiality-only, no-integrity/availability impact - not a mass-exploitable listening-service RCE. |
| Exploit ScenarioDerived | An attacker stands up a malicious remote MCP server and induces a user to configure mcp-remote (0.1.32-0.1.38) to connect to it. During OAuth discovery the server returns crafted authorization-server metadata (handled by authorization-server-metadata.ts/utils.ts) that points mcp-remote at internal or otherwise-unreachable URLs, causing the client to issue server-side requests and disclose the responses. A public technical advisory (playb0t/mcp-remote-oauth-security, F-02) documents the SSRF with reproduction detail, though no confirmed active exploitation exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Server-side request forgery during OAuth authorization-server metadata discovery in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information from the environment where the client runs. The client trusts an attacker-supplied authorization-server metadata/endpoint URL handled in src/lib/authorization-server-metadata.ts and src/lib/utils.ts without adequate validation, so a victim who connects mcp-remote to an attacker-controlled or attacker-influenced remote MCP server triggers requests to internal targets and discloses the responses. The NVD vector scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) while the independent assessment scores UI:R because the victim must initiate the connection to the malicious server; impact is confidentiality-only, with no integrity or availability effect, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, so the primary action is to stop running the affected range: do not deploy mcp-remote 0.1.32 through 0.1.38, and move to a release after 0.1.38 once a fixed version is confirmed on https://github.com/geelen/mcp-remote/security/advisories. If upgrading is not immediately possible, apply egress filtering on the host running mcp-remote and deny outbound connections to loopback, RFC1918 ranges, and link-local cloud-metadata addresses such as 169.254.169.254 - the trade-off is that legitimate MCP or OAuth servers hosted on internal networks will also be blocked. In parallel, only connect mcp-remote to MCP/OAuth servers that are trusted and independently verified, confirming that the authorization-server metadata URL resolves to the expected issuer host before the client follows it, and run the client in a sandboxed or containerized network namespace with restricted egress; these reduce exposure but do not repair the missing URL validation. Because exploitation is user-initiated - the victim must start a connection to a malicious server - user awareness of untrusted MCP server URLs is a necessary complement to the technical controls. References: https://github.com/geelen/mcp-remote, https://github.com/geelen/mcp-remote/security/advisories, https://github.com/playb0t/mcp-remote-oauth-security.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-remote is an npm/Node.js client that lets MCP (Model Context Protocol) hosts talk to remote MCP servers, which includes handling OAuth flows and authorization-server metadata discovery in the style of RFC 8414/OIDC discovery. The weakness class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the discovery logic in src/lib/authorization-server-metadata.ts, with helpers in src/lib/utils.ts, fetches a metadata document whose URL is influenced by the remote server without validating that the resulting request targets only legitimate, externally reachable authorization endpoints. That is the classic server-side request forgery pattern - echoed by the third-party advisory track naming (playb0t/mcp-remote-oauth-security, F-02-authorization-server-ssrf) - and lets an attacker point the client at loopback, RFC1918, or cloud link-local metadata addresses (for example 169.254.169.254) and read back the responses. The CPE feed is unpopulated (cpe:2.3:a:n/a:n/a), so exact product identity must be taken from the project itself: the geelen mcp-remote npm package, with only versions 0.1.32 through 0.1.38 in scope and releases outside that window unaffected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network SSRF requiring the victim to connect the client to a malicious server (UI:R), no auth needed (PR:N); confidentiality-only disclosure of internal responses (C:H, I/A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components
Executive ViewAI
The geelen mcp-remote client versions 0.1.32 through 0.1.38 contain a server-side request forgery flaw that can expose sensitive internal environment data when developers connect to an attacker-controlled Model Context Protocol server. This affects development and automation environments where the tool is used, potentially leaking cloud credentials or internal service responses. Leadership should prioritize mitigation because no vendor patch is currently available and the tool is often deployed on workstations with broad network access.
No vendor patch available; restrict mcp-remote usage to trusted MCP servers, implement egress filtering to block requests to internal/link-local IP ranges and cloud metadata endpoints, isolate affected clients in a segmented network, and monitor for anomalous outbound requests from mcp-remote processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB