Attackers can exploit unauthenticated access and cross-origin issues in MCP Inspector, risking system compromise and unauthorized code execution.
A critical remote code execution vulnerability, tracked as CVE-2025-49596, has been identified in a widely used open-source utility for testing and troubleshooting Model Context Protocol (MCP) servers.
The flaw, which carries a CVSS score of 9.4, exposes systems to complete compromise with minimal user interaction.
The vulnerability affects all MCP Inspector versions from Anthropic prior to 0.14.1. The core technical issues are as follows:
- Unauthenticated Remote Code Execution: The MCP Inspector Proxy component, by default, listens on all network interfaces and lacks authentication. Attackers on the same network or with access to a public-facing instance can inject commands and execute arbitrary code with the privileges of the proxy process.
- Web UI exposure: The MCP Inspector’s web interface, available at http://127.0.0.1:6274, does not require authentication in affected versions, allowing any local or remote web page to interact with the proxy.
- CORS misconfiguration: The proxy accepts cross-origin requests from any origin by default, enabling attackers to exploit users by tricking them into visiting malicious websites that send crafted requests to the local proxy.
- DNS rebinding risk: The lack of network restrictions and insufficient control over the Host header allows DNS rebinding attacks, which can bypass browser same-origin policies and target local services.
- Indicators of Compromise and exploitation scenarios:
- Unexpected processes spawned by the MCP Inspector proxy
- Outbound connections initiated from the proxy to attacker-controlled hosts
- Reverse shell payloads executed via HTTP requests to the proxy’s SSE endpoint
Remediation steps
Affected teams need to upgrade to MCP Inspector version 0.14.1 or later, and review any software that includes the MCP Inspector package and update dependencies accordingly.
According to Rémy Marot, Staff Research Engineer, Tenable, his firm had disclosed discovery of the vulnerability through a coordinated process with Anthropic’s security team: the proper update “enforces authentication, binds services to localhost, and restricts trusted origins, closing critical attack vectors. Prioritize robust security policies before deploying AI tools to mitigate these inherent risks.”
