PT-2025-25442 · Unknown · Mcp Inspector

Rémy Marot · Published 2025-03-26 · Updated 2026-06-16 · CVE-2025-49596

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MCP Inspector versions prior to 0.14.1

Description The MCP Inspector is a developer tool used for testing and debugging MCP servers. Versions prior to 0.14.1 are vulnerable to remote code execution (RCE) due to a lack of authentication between the Inspector client and proxy. This allows unauthenticated requests to launch MCP commands over stdio. The vulnerability is exploitable by chaining a known flaw affecting modern web browsers (0.0.0.0 Day) with a cross-site request forgery (CSRF) vulnerability. An attacker can execute arbitrary code on a developer's machine by tricking them into visiting a malicious website. The default configurations of the tool expose it to significant security risks, including missing authentication and encryption. The vulnerability has a CVSS score of 9.4 and is considered critical.

Recommendations Upgrade to MCP Inspector version 0.14.1 or later.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-09370

CVE-2025-49596

GHSA-7F8R-222P-6F5G

Affected Products

Mcp Inspector

References · 121

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49596.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-49596 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49596 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f8r-222p-6f5g · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09370 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-49596 · Vendor Advisory
• https://github.com/modelcontextprotocol/inspector · Note
• https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979 · Note
• https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g · Note
• https://twitter.com/triepod_ai/status/1942182591127290099 · Twitter Post
• https://twitter.com/hereticreader/status/1940777172857508301 · Twitter Post
• https://twitter.com/MalwarePatrol/status/1940458246239646008 · Twitter Post
• https://t.me/aptreports/23880 · Telegram Post
• https://twitter.com/jjackyliang/status/1948452874054443420 · Twitter Post
• https://twitter.com/TechNadu/status/1943299540926271863 · Twitter Post