CVE-2025-49596 MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Unauthenticated access to the MCP Inspector proxy allows attackers to execute arbitrary commands, requiring an immediate upgrade.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-49596?
CVE-2025-49596 is a critical missing authorization vulnerability in modelcontextprotocol inspector, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.
Weakness: CWE-306
Which versions are affected by CVE-2025-49596?
2 open source packages ship an affected version, including @modelcontextprotocol/inspector.
| Package | Affected | Fixed in |
|---|---|---|
@modelcontextprotocol/inspector npm | All versions | 0.14.1 |
@modelcontextprotocol/inspector npm | All versions | 0.14.1 |
How do I fix CVE-2025-49596?
Upgrade @modelcontextprotocol/inspector to 0.14.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-49596 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49596 exists.
Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.
Sources
Also known as GHSA-7f8r-222p-6f5g, ROOT-APP-NPM-CVE-2025-49596.