Executive brief
The mcp-use inspector proxy middleware improperly validates target URLs, allowing attackers to proxy requests to private, loopback, and link-local addresses that should be restricted. This enables an attacker to make the server access internal services (databases, admin panels, local APIs) and read their responses, potentially leading to data theft or unauthorized operations on systems only reachable from the server itself.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in mountMcpProxy (libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts). The proxy reads the target URL from the X-Target-URL header or __mcp_target parameter and forwards requests without proper validation of the resolved IP address. The flaw allowed requests to private ranges (RFC 1918), loopback (127.0.0.1), and link-local addresses; additionally, HTTP redirects were not re-validated, allowing chaining attacks. The fix implements isSafeProxyTarget to check resolved addresses against restricted ranges and limits redirect chains. Network-accessible to any caller; no authentication bypass required beyond having network access to the proxy.
Affected products
- mcp-use mcp-use prior to patch (CVE-2026-81091 fix)
Timeline
- 2026-08-27: disclosed: CVE-2026-81091 published
- 2026-08-27: patched: Fix implemented with isSafeProxyTarget validation and redirect limiting