CVE-2026-51994
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header.
Risk Assessment
An attacker can exploit this vulnerability to make unauthorized requests on behalf of the server, potentially leading to disclosure of internal resources or attacks on other systems.
Recommendation
Update mcp-remote to a version that includes a fix for this vulnerability.
Other vulnerabilities in mcp-remote
See all- CVE-2026-51996Critical
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function.
- CVE-2026-108716Medium
mcp-remote 0.8.0 through 0.14.3 has a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback HTTP URLs, on-path network attackers can capture the client secret plus issued access and refresh tokens.
- CVE-2026-52001High
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper in src/lib/utils.ts.
- CVE-2026-51997High
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions.
Original NVD description (English source)
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header
Vulnerability data from NVD (NIST) · CISA KEV · EPSS