CVE-2026-51994: mcp-remote 0.1.32 to 0.1.38 fetches a resource_metadata URL from a malicious MCP server without any address checks (SSRF)
mcp-remote, the widely used npm bridge that lets local MCP clients talk to remote MCP servers, takes the resource_metadata URL from a remote server's WWW-Authenticate header during OAuth discovery and fetches it with no scheme, hostname or private-address policy. A malicious MCP server can therefore make the client send HTTP requests to localhost services, private network addresses or cloud metadata endpoints reachable from the user's machine. The researcher confirmed this on 0.1.38 with a localhost canary.
What it is
When a remote MCP server answers with 401 and a crafted WWW-Authenticate header, mcp-remote 0.1.32 through 0.1.38 requests the resource_metadata URL it names without checking where it points (CWE-918).
The destination can be a loopback service, a private network address or a cloud metadata endpoint, as long as the client host can reach it.
The public write-up (finding F-01 in playb0t/mcp-remote-oauth-security) demonstrated that the request is issued; it did not demonstrate reading the response back. It was first confirmed on 17 February 2026 and reconfirmed against 0.1.38 on 3 May 2026.
The attack needs the user to configure or connect to an attacker-controlled MCP server.
How to check
- Affected: mcp-remote (npm) 0.1.32 through 0.1.38, per the CVE record. The advisory does not name a fixed release.
- Check every MCP client config (Claude Desktop, Cursor, Windsurf and others) for npx mcp-remote entries, and note whether they pin a version.
How to fix
- Move to the newest mcp-remote release and pin it in your MCP configs instead of running an unpinned or old version, then confirm in mcp-remote's changelog that resource_metadata destinations are validated.
- Only connect mcp-remote to MCP servers you trust.
- On cloud machines, require IMDSv2 or block the metadata address for processes that don't need it, so a stray request can't pull credentials.
grep -rn 'mcp-remote' ~/.cursor ~/Library/Application\ Support/Claude 2>/dev/null
npm view mcp-remote versionSources
- criticalCVE-2026-114612: LiteLLM proxy lets an internal user forge an admin token and run commands
- criticalMalicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude
- criticalCVE-2026-114125: A malicious website can tamper with your project through a running Storybook dev server
- criticalCVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress