Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81091— mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

Quick assessment

Affected
mcp-use mcp-use
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mcp-use 检查器中的代理中间件会将请求转发到调用者指定的目标地址。在文件 中的 函数会从 请求头或 参数读取目标地址，并在不检查其宿主机的情况下直接进行代理转发。因此，回环地址、链路本地地址和私有地址均被接受，解析为这些地址的主机名也未被过滤，且当目标端返回重定向时，校验逻辑并未在重定向上重新应用。由此，调用者可以促使服务器向仅在其运行主机上可达的地址发起请求，并读取相应的响应。当前代码调用了 函数，该函数在代理之前会将解析后的地址与私有、回环及链路本地地址段进行比对，并限制所跟随的重定向次数。

CVSS 8.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
mcp-use mcp-use ≤ 2.3.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81091

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
Source: CVE Program / CVE List V5
Vulnerability Description
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
mcp-use mcp-use 0 ~ 2.3.2 -

II. Public POCs for CVE-2026-81091

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81091

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81091 (2)

Security Blog Posts for CVE-2026-81091 (1)

IV. Related Vulnerabilities

Same weakness: CWE-918

V. Comments for CVE-2026-81091

No comments yet

Leave a comment