Yotam Perkal

**Name of the Vulnerable Software and Affected Versions** mcp-use (affected versions not specified) **Description** The proxy middleware in the inspector forwards requests to a destination specified by the caller. The `mountMcpProxy` function in `libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts` reads the target from the `X-Target-URL` header or the ` mcp target` parameter and proxies the request without inspecting the host. This allows the acceptance of loopback, link-local, and private addresses, as well as names that resolve to them. Additionally, validation is not reapplied to redirects returned by the destination. Consequently, a caller can force the server to issue requests to addresses reachable only from the host where the server is running and read the responses. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCP server versions prior to 0.9.12 **Description** The `get-html-skeleton` tool allows for Server-Side Request Forgery (SSRF) because it fetches a user-supplied URL after performing only a syntax check. The handler in `src/tools/common/get html skeleton.ts` uses the `isValidHttpUrl()` function from `src/utils/generic.ts`, which only verifies that the string starts with an http or https scheme and is a valid URL format. It does not inspect the host name or the resolved address, allowing requests to loopback, link-local, and private IP ranges, including cloud provider instance metadata services. An attacker can use this to request internal endpoints reachable only from the host and retrieve sensitive information, such as instance credentials. **Recommendations** Update to version 0.9.12, which removes the `get-html-skeleton` tool.

**Name of the Vulnerable Software and Affected Versions** mcp-router versions prior to 0.6.3 **Description** The CLI serves its MCP aggregator on every network interface by default and only enforces authentication if explicitly requested by the operator. In the `serve` command located in `apps/cli/src/commands/serve.ts`, the host defaults to the all-interfaces address on a fixed port and requires a token only when a specific flag is provided. Consequently, a default invocation exposes the aggregator and all connected MCP servers to any user capable of reaching the port. **Recommendations** Update to version 0.6.3 or later.