Mcp Use
Monthly
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.