EUVD-2026-67146
GHSA-23qx-5wch-w72w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable proxy requires no credentials or interaction; SSRF yields high confidentiality impact only, no integrity or availability effect; scope unchanged as impacted system is the proxied internal host within same trust boundary.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
AnalysisAI
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The mcp-use inspector proxy service must be network-accessible to the attacker - no authentication, no special configuration, and no user interaction are required beyond the ability to send HTTP requests to the inspector endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scoring 8.7 correctly reflects low-friction, unauthenticated network exploitation with a high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to an exposed mcp-use inspector sends a GET request with an X-Target-URL header set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). The inspector proxy forwards the request without host validation, receives the cloud credential response, and returns it in full to the attacker - yielding IAM role credentials usable for lateral movement into the AWS environment. … |
| Remediation | Upgrade mcp-use to the version that incorporates the isSafeProxyTarget host-validation guard, as described in the vendor security advisory at https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all mcp-use deployments and apply immediate firewall restrictions to inspector proxy access, blocking external and untrusted internal connections to trusted IPs only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today