MCPA-2025-0003
criticalauth-missingCVSS 9.4
MCP Inspector proxy allows unauthenticated remote code execution (CVE-2025-49596)
Versions of Anthropic's MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests (including from malicious websites via CSRF) to launch arbitrary MCP commands over stdio on the developer's machine.
MCP Inspector is the standard developer tool for testing and debugging MCP servers (38k+ weekly npm downloads at time of disclosure). Discovered by Tenable Research and disclosed in coordination with Anthropic. The proxy accepted unauthenticated requests, so any process or web page that could reach it could spawn commands. Fixed in 0.14.1, which adds session-token authentication.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @modelcontextprotocol/inspector | >= 0.0.0, < 0.14.1 |
Identifiers
CVE-2025-49596GHSA-7f8r-222p-6f5gCWE-306
References
- advisory https://github.com/advisories/GHSA-7f8r-222p-6f5g
- advisory https://nvd.nist.gov/vuln/detail/CVE-2025-49596
- report https://www.tenable.com/blog/how-tenable-research-discovered-a-critical-remote-code-execution-vulnerability-on-anthropic
Timeline
- Published: 2025-06-13
Credits
- Tenable Research