Vulnerability Description
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/mcp-use/mcp-use
- https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p
- https://www.vulncheck.com/advisories/mcp-use-inspector-proxy-server-side-request
FAQ
What is CVE-2026-81091?
CVE-2026-81091 is a vulnerability with a CVSS score of 8.6 (HIGH). The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target ...
How severe is CVE-2026-81091?
CVE-2026-81091 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81091?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.