CVE-2026-51995

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.32 through 0.1.38

Description A remote attacker can obtain sensitive information, including internal configuration and values, by triggering metadata processing. The issue resides in the authorization server metadata handling within the src/lib/authorization-server-metadata.ts component and the parsing logic in src/lib/utils.ts. Local-only deployments that do not expose the metadata endpoint are not impacted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the metadata endpoint to minimize the risk of exploitation.