GitHub Advisoryadvisory · npm

GHSA-7f8r-222p-6f5g MCP Inspector proxy server lacks authentication between the Inspector client and proxy

CRITICAL Published 2025-06-13 Modified 2025-07-09 Official page ↗
Aliases
CVE-2025-49596
Ecosystem
npm
Packages
@modelcontextprotocol/inspector
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weaknesses
CWE-306
Reviewed
2025-06-13

Affected packages

• npm @modelcontextprotocol/inspector: < 0.14.1 → fixed in 0.14.1

Description

Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities. Credit: Rémy Marot

Related

Alias · CVE (1)

  • CVE-2025-49596 The MCP inspector is a developer tool for testing and debugging MCP servers. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References