CVE-2025-49596
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
- Record
CVE-2025-49596- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2025-20870
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
- Record
EUVD-2025-20870- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7f8r-222p-6f5g
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Credit: Rémy Marot [email protected]
- Record
GHSA-7f8r-222p-6f5g- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
- Record
CVE-2025-49596- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-306
- Updated
- 2026-11-02
OSV
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
- Record
CVE-2025-49596- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVGHSA-7f8r-222p-6f5g
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Credit: Rémy Marot [email protected]
- Record
GHSA-7f8r-222p-6f5g- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2025-49596 No score
CVE-2025-49596 in @rootio/modelcontextprotocol__inspector - Patched by Root
Root has patched CVE-2025-49596 in the @rootio/modelcontextprotocol__inspector package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2025-49596- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@modelcontextprotocol/inspectornpm |
before 0.14.1 | 0.14.1 |
@rootio/modelcontextprotocol__inspectorRoot:npm |
before 0.4.1-root.io.1 | 0.4.1-root.io.10.4.1-root.io.20.4.1-root.io.3 |
@modelcontextprotocol/inspectorRoot:npm |
before 0.4.1-aikido.3 | 0.4.1-aikido.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | MCP Inspector < 0.14.0 UnauthenticatedRemote Code Execution | |
| PoC in GitHub | RajSidwadkar/UAP-protocol | 2026-06-06 |
| PoC in GitHub | acseguin21/trust-boundary-ctf | 2026-04-10 |
| PoC in GitHub | ashiqrehan-21/MCP-Inspector-CVE-2025-49596 | 2025-07-03 |
| PoC in GitHub | pppxo/CVE-2025-49596-PoC | 2026-03-25 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49596 is a critical vulnerability (CVSS 9.4) in Mcpjam Inspector, published June 13, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 44.5%, the 98th percentile. Fixed in @modelcontextprotocol/inspector 0.14.1.
References
github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g
thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis
oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
nvd.nist.gov/vuln/detail/CVE-2025-49596