mcp-use Inspector CVE-2026-81091

The mcp-use inspector proxy service must be network-accessible to the attacker - no authentication, no special configuration, and no user interaction are required beyond the ability to send HTTP requests to the inspector endpoint. The CVSS vector (PR:N/UI:N/AV:N) confirms unauthenticated exploitation with no prerequisite conditions on the target. Exploitation is limited by deployment context: the inspector is a development/debugging tool and may not be exposed in production environments. Redirect-following SSRF (the secondary attack path) requires that the attacker controls or can predict a redirect-capable intermediate endpoint, but the primary path (direct X-Target-URL or __mcp_target injection) has no such requirement.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scoring 8.7 correctly reflects low-friction, unauthenticated network exploitation with a high confidentiality impact. There is no KEV listing and no public proof-of-concept identified at time of analysis, so while the theoretical risk is high, observed exploitation has not been confirmed by CISA. EPSS data was not provided in the source intelligence. The primary real-world risk vector is cloud-hosted deployments where the mcp-use inspector is exposed and an attacker uses SSRF to reach instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal Kubernetes API servers, or other management interfaces not intended to be internet-reachable. The inspector is a developer and debugging tool; deployments in production or internet-exposed environments may be limited, which tempers the practical blast radius despite the high score. No conflict between CVSS signals and description is present - both consistently indicate remote, unauthenticated, read-only SSRF. Redirect-following without revalidation slightly elevates practical exploitability beyond a basic SSRF.

An attacker with network access to an exposed mcp-use inspector sends a GET request with an X-Target-URL header set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). The inspector proxy forwards the request without host validation, receives the cloud credential response, and returns it in full to the attacker - yielding IAM role credentials usable for lateral movement into the AWS environment. No public proof-of-concept is identified at time of analysis, but the technique is well-documented for SSRF vulnerabilities of this class.