CVE-2026-81091: mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the proxy middleware that reads the destination from the X-Target-URL header or __mcp_target parameter so it inspects the resolved host before proxying and re-validates the host for redirects returned by the destination. Do not accept loopback, link-local, or private-address targets.
mcp-use Inspector Proxy Server (libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) X-Target-URL / __mcp_target host validation = Re-apply isSafeProxyTarget checks for resolved destination hosts on initial request and on any redirected destinations; reject loopback, link-local, and private address ranges
Event History
Frequently Asked Questions
Who can exploit this issue?
Any caller that can send requests through the Inspector proxy can supply a destination using the X-Target-URL header or the __mcp_target parameter. No authentication or user interaction is indicated by the provided vector.
What internal resources could be exposed?
The proxy could be used to request loopback, link-local, and private network addresses, including hostnames that resolve to those address ranges. An attacker could read responses from services reachable from the Inspector Proxy Server host.
Are redirects relevant to exploitation?
Yes. The prior behavior did not reapply target validation after a destination returned a redirect, allowing redirects to potentially reach an unsafe address. The current code bounds redirects and validates resolved addresses before proxying.
How can I determine whether my deployment is affected?
Inspect the proxy implementation used by mountMcpProxy. Affected behavior accepts caller-provided X-Target-URL or __mcp_target values without checking the resolved host against private, loopback, and link-local ranges, and does not revalidate redirect targets.