EUVD-2026-86021
GHSA-4gh6-j99c-x6g2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim connects mcp-remote via SSE transport
-
DeliveryAttacker-influenced origin receives SSE fetch
-
ExploitMis-scoped fetch wrapper forwards OAuth token
-
ExecutionAttacker captures leaked bearer credential
-
ImpactReplay token to access MCP resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to use mcp-remote versions 0.1.18 through 0.1.38 with the SSE transport, where the eventSourceInit fetch wrapper (src/lib/utils.ts) attaches the OAuth/authorization token without correctly scoping it to the intended server origin, causing the credential to be sent to an unintended endpoint. Exploitation is limited to deployments actually using the SSE transport (not the streamable-HTTP/stdio paths) and requires the attacker to be positioned to receive the mis-scoped request - e.g. controlling or observing the out-of-scope origin to which the token leaks. There is no impact to integrity or availability; exposure is confined to confidentiality of the forwarded token. |
| Impact | Signals are consistent and point to a moderate credential-exposure issue rather than a mass-exploitation emergency. CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) reflects a network-reachable, unauthenticated, confidentiality-only flaw with no integrity or availability impact. EPSS is low at 0.25% (14th percentile), the CVE is NOT on CISA KEV, and the input provides no confirmed POC flag, so there is no evidence of active or automated exploitation. The referenced third-party research (playb0t/mcp-remote-oauth-security, advisory F-11 'sse-token-origin-scope') indicates an OAuth/token origin-scoping weakness in the SSE transport's fetch wrapper, consistent with CWE-200 and the C:H rating (leaked bearer tokens). Caveat: the CVSS PR:N/AC:L scoring implies trivial remote exploitation, but token-scope leakage realistically requires the victim's mcp-remote client to use the SSE transport AND an attacker positioned to receive credentials forwarded to an unintended origin - real-world exploitation is more conditional than the raw vector suggests. Net: a legitimate fix-worthy credential-disclosure bug, but low urgency absent KEV/POC signals. |
| Exploit ScenarioDerived | A developer runs mcp-remote (0.1.18-0.1.38) to proxy an MCP client to a remote server over the SSE transport. Because the eventSourceInit fetch wrapper in src/lib/utils.ts does not correctly scope the token to the intended origin, the OAuth bearer token is forwarded to an unintended endpoint observable by a remote attacker, who harvests it and replays it against the legitimate MCP server. No public exploit is identified at time of analysis, though a third-party security advisory documenting the flaw is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Credential exposure in geelen's mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to capture OAuth/authorization tokens by abusing the SSE transport's eventSourceInit fetch wrapper in src/lib/utils.ts, which attaches credentials without correctly scoping them to the intended server origin. Only deployments actually using the SSE transport path are affected; the streamable-HTTP and stdio paths do not exhibit this behavior, and exploitation further requires the attacker to control or observe the out-of-scope origin that receives the leaked token. Impact is limited to confidentiality of the forwarded token (no integrity or availability effect), there is no public exploit identified at time of analysis, and EPSS is low at 0.25% (14th percentile), indicating a moderate credential-exposure issue rather than a mass-exploitation emergency.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to stop running the affected SSE code path and to rotate any credentials it may have exposed: upgrade mcp-remote beyond the stated affected range (0.1.18 through 0.1.38) to the newest published release and confirm the fix against the project's advisory at https://github.com/geelen/mcp-remote/security/advisories before assuming remediation. If an upgrade is not immediately possible, the most effective compensating control is to stop using the SSE transport entirely and switch remote MCP servers to the streamable-HTTP transport, or continue with local stdio servers only; the trade-off is loss of connectivity to legacy remote MCP servers that only speak SSE. A second actionable control is to shorten OAuth token lifetimes and narrow token scopes/audiences so that any token leaked to an out-of-scope origin is short-lived and low-privilege, at the cost of more frequent re-authorization and possible breakage of long-running integrations. Treat all OAuth/authorization tokens that were minted while the SSE transport was in use with mcp-remote 0.1.18-0.1.38 as potentially compromised and revoke or rotate them, since the confidentiality impact is on the token itself rather than on data at rest. As monitoring, review outbound request logs from mcp-remote hosts for Authorization headers sent to origins other than the configured MCP server (relevant CWE-200 exposure detection), and validate that token issuer audience restrictions would reject replay from an unintended origin. Do not rely on network-perimeter controls alone; this is a client-side credential-scoping defect that must be fixed in the client or by removing the SSE transport from the deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
mcp-remote is a proxy/bridge client that connects local stdio-based Model Context Protocol (MCP) clients to remote MCP servers, including via Server-Sent Events (SSE) transport. In the affected range, the SSE transport path uses an eventSourceInit fetch wrapper implemented in src/lib/utils.ts that injects the Authorization header (OAuth token) on outgoing requests. The wrapper fails to validate that the request target matches the origin of the intended MCP server, so the token can be forwarded to an origin outside the intended scope. This is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the root cause is a missing origin/audience binding check on credentialed outbound requests during transport negotiation or redirect handling, not a memory-safety or injection flaw. Because the leak is a bearer-style OAuth credential, the practical risk is downstream token replay or unauthorized access to whatever resources that token authorizes, until the token expires or is revoked. Our independent assessment applies AC:H rather than the published AC:L: capitalizing on the flaw is not simple automation - it depends on the victim runtime actually using the SSE transport and on an attacker being positioned to receive or intercept the mis-scoped request. The upstream project and its security advisories page (github.com/geelen/mcp-remote/security/advisories) plus a third-party write-up (playb0t/mcp-remote-oauth-security, advisory F-11-sse-token-origin-scope) document the token-origin scoping weakness.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable credential leak with no auth (PR:N), but AC:H because the attacker must be positioned to receive the mis-scoped SSE token; confidentiality-only (C:H, I/A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts
Executive ViewAI
geelen's mcp-remote versions 0.1.18 through 0.1.38 contain a credential exposure flaw in the SSE transport path that could allow a remote attacker to capture OAuth/authorization tokens, potentially enabling unauthorized access to connected services. This affects only deployments using SSE transport, and while exploitation requires the attacker to control an out-of-scope origin, the confidentiality impact could lead to lateral movement or data breaches. Leadership should prioritize remediation because tokens may grant access to critical systems, and no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: disable SSE transport if not required; restrict outbound network access to trusted origins; monitor for unauthorized token use; rotate potentially exposed OAuth tokens.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB