CVE-2026-51994: SSRF
Published Sep 24, 2026
·Updated
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header
Affected Software
1 affected component
npm/mcp-remote>=0.1.32<=0.1.38
Event History
Sep 24, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:17 PM
Description
Frequently Asked Questions
1
What would an attacker need to control to exploit this issue?
An attacker would need a remote MCP server that can provide a WWW-Authenticate header containing a resource_metadata URL. The vulnerable client versions may then make a server-side request to that URL.
2
How can I determine whether an installation is affected?
Check whether the installation uses npm/mcp-remote version 0.1.32 through 0.1.38. Exposure is relevant when the client connects to remote MCP servers that can return WWW-Authenticate headers.