MCP Inspector Unauthenticated Proxy RCE

Product: Anthropic MCP Inspector
CVE: CVE-2025-49596
Disclosed: 2025-06-13
CVSS: —
Auth: pre-auth
CISA KEV: no
Affected: MCP Inspector < 0.14.1
Fixed: 0.14.1

Summary

The official MCP Inspector developer tool ran a local proxy that would launch any command it was told to, with no authentication. Oligo showed a malicious website could reach it from a developer's browser and execute code.

Root cause

The Inspector proxy (port 6277) accepted requests on its /sse endpoint specifying transportType=stdio plus an arbitrary command and args, which it spawned to 'connect' to an MCP server. It had no session token or origin checks and bound to all interfaces, so browser requests to 0.0.0.0 (the '0.0.0.0-day' behavior) or CSRF/DNS rebinding could trigger it.

Impact

Remote code execution on developer machines simply by visiting a malicious page while the Inspector runs.

Public PoC

http://0.0.0.0:6277/sse?transportType=stdio&command=touch&args=%2Ftmp%2Fexploited-from-the-browser

Source: Oligo Security

Detection

Check for @modelcontextprotocol/inspector < 0.14.1; look for requests to :6277/sse with transportType=stdio from browser origins.

Mitigation

Upgrade to 0.14.1+, which adds session tokens and origin validation, and bind dev tools to localhost.