CVE-2026-51994: mcp-remote SSRF Vulnerability

CVE-2026-51994 Overview

CVE-2026-51994 is a Server-Side Request Forgery (SSRF) vulnerability in mcp-remote, a client bridge for the Model Context Protocol (MCP). Versions 0.1.32 through 0.1.38 extract a resource_metadata URL from a remote MCP server's WWW-Authenticate HTTP header and issue a request to that URL without validation. A malicious MCP server can direct the client to arbitrary internal endpoints, cloud metadata services, or loopback addresses. The flaw is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
An attacker-controlled MCP server can coerce mcp-remote clients into issuing authenticated requests to internal infrastructure, exposing cloud instance metadata, internal APIs, and sensitive services behind the client's network boundary.

Affected Products

mcp-remote version 0.1.32
mcp-remote versions 0.1.33 through 0.1.37
mcp-remote version 0.1.38

Discovery Timeline

2026-09-24 - CVE-2026-51994 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-51994

Vulnerability Analysis

The mcp-remote package bridges local MCP clients to remote MCP servers over HTTP. When a remote server returns an authentication challenge, mcp-remote parses the WWW-Authenticate response header and follows OAuth 2.0 Protected Resource Metadata discovery as defined in RFC 9728. The client extracts the resource_metadata parameter and performs an outbound HTTP request to fetch the metadata document.

The implementation trusts the URL provided by the remote server. No allowlist, scheme restriction, or network boundary check validates the target before the request is dispatched. A hostile MCP server can therefore steer the client into contacting any reachable network location.

Successful exploitation lets an attacker enumerate internal services, reach cloud instance metadata endpoints such as 169.254.169.254, and read responses that may leak IAM credentials or configuration data. The impact extends to any host the mcp-remote process can reach from its network position.

Root Cause

The root cause is missing validation of the resource_metadata URL extracted from the untrusted WWW-Authenticate header. The client performs the follow-up HTTP request without constraining scheme, host, or address range, satisfying the preconditions of CWE-918.

Attack Vector

The attack requires a user to connect mcp-remote to an attacker-controlled or compromised MCP server. The malicious server responds with an HTTP 401 and a crafted WWW-Authenticate header whose resource_metadata points at an internal target. The client then issues the SSRF request on the attacker's behalf. See the SSRF Vulnerability Advisory for the full technical write-up.

No exploitation code is reproduced here. Refer to the published advisory for proof-of-concept details.

Detection Methods for CVE-2026-51994

Indicators of Compromise

Outbound HTTP requests from hosts running mcp-remote to RFC 1918 ranges, link-local 169.254.0.0/16, or 127.0.0.0/8 shortly after an MCP server connection.
WWW-Authenticate headers from remote MCP servers containing resource_metadata URLs pointing at non-public hosts.
Unexpected access entries in cloud instance metadata service (IMDS) logs correlated with developer or build-system IP addresses.

Detection Strategies

Inspect egress proxy and firewall logs for requests originating from mcp-remote processes targeting internal address ranges or metadata endpoints.
Audit installed Node.js package versions across developer workstations and CI runners for mcp-remote in the 0.1.32–0.1.38 range using npm ls mcp-remote.
Correlate process telemetry showing node or npx mcp-remote invocations with subsequent connections to sensitive internal services.

Monitoring Recommendations

Enforce IMDSv2 on AWS workloads and monitor IMDS access patterns for anomalies.
Alert on any process named mcp-remote resolving or connecting to internal DNS names outside an approved allowlist.
Track MCP server endpoints used by developers and flag connections to newly observed or untrusted remote hosts.

How to Mitigate CVE-2026-51994

Immediate Actions Required

Upgrade mcp-remote to a version later than 0.1.38 that validates resource_metadata targets, per the project security advisories.
Inventory all workstations, CI pipelines, and container images that install mcp-remote and remove or pin out of the vulnerable range.
Restrict developer egress so mcp-remote processes cannot reach cloud metadata services or internal management interfaces.

Patch Information

Review the vendor's GitHub Security Advisories page for the fixed release and update guidance. The upstream repository is published at geelen/mcp-remote. Additional context on the MCP OAuth attack surface is maintained at the MCP Remote OAuth Security overview.

Workarounds

Only connect mcp-remote to trusted, first-party MCP server endpoints until a patched version is deployed.
Route mcp-remote traffic through an egress proxy that denies requests to RFC 1918, loopback, and link-local destinations.
Block access to 169.254.169.254 from developer and build environments where MCP clients run, and require IMDSv2 session tokens on supported cloud platforms.

bash

# Verify installed mcp-remote version and remove vulnerable releases
npm ls -g mcp-remote
npm uninstall -g mcp-remote
npm install -g mcp-remote@latest