MCP Inspector Unauthenticated RCE (CVE-2025-49596)
First seen Jul 3, 2026 · Updated Jul 3, 2026 · CVSS 9.4
The MCP Inspector developer tool shipped a proxy that lacked authentication, allowing browser-based attackers to reach it from a malicious web page and execute code on the developer's machine. Reported by Oligo Security with a CVSS score of 9.4.
Technical Analysis
Inspector's local proxy accepted commands without verifying the caller, so a drive-by page could target the well-known local port and drive the tool into spawning processes. The pattern generalizes: local agent tooling that binds unauthenticated servers converts every browser tab into a potential bridge to the agent host.
Affected Systems
MCP Inspector prior to 0.14.1; protocols: MCP
Detection Signatures
- Inspector proxy ports reachable without a session token
- Browser-origin requests hitting local agent tooling ports
- Inspector versions below 0.14.1 in developer environments
Remediation Steps
- 1
Upgrade Inspector
Move to 0.14.1 or later, which adds session tokens and origin checks.
- 2
Bind to localhost with auth
Require authentication on all local agent tooling; never expose it on 0.0.0.0.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.