CVE-2026-51994

Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.1.32 through 0.1.38

Description The software is subject to Server-Side Request Forgery (SSRF), a flaw that allows a server to make requests to an unintended location. This occurs because the application trusts and fetches the resource metadata URL extracted from a remote MCP server's WWW-Authenticate header, allowing requests to be sent to internal or metadata endpoints chosen by an attacker. This issue is network exploitable and requires no privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.