mcp-remote OAuth Command Injection (CVE-2025-6514)
First seen Jul 3, 2026 · Updated Jul 3, 2026 · CVSS 9.6
A critical flaw in the widely used mcp-remote OAuth proxy let malicious MCP servers achieve remote code execution on connecting developer machines, turning a routine agent connection into full host compromise. The package had hundreds of thousands of downloads before patching.
Technical Analysis
mcp-remote bridges local clients to remote MCP servers and handles OAuth discovery. A hostile server could supply authorization metadata that the proxy passed into system URL handling without validation, yielding command injection during the connection handshake. Because the component sits in the trust path for many agent setups, one malicious endpoint compromised the host running the agent.
Affected Systems
mcp-remote versions prior to the patched release; protocols: MCP, OAuth
Detection Signatures
- Agent hosts initiating OAuth flows to unfamiliar MCP endpoints
- mcp-remote present at a vulnerable version in lockfiles
- Unexpected child processes spawned during MCP connection setup
Remediation Steps
- 1
Update mcp-remote
Upgrade to the patched release everywhere, including CI images and dev containers.
- 2
Allowlist MCP endpoints
Restrict agents to an approved list of remote MCP servers.
- 3
Prefer HTTPS-only remotes
Reject plain HTTP MCP endpoints in client configuration.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.