{
 "public_id": "AIR-2025-0041",
 "incident_id": "2025-06-anthropic-mcp-inspector-rce",
 "date_disclosed": "2025-06-13",
 "date_occurred": null,
 "title": "CVE-2025-49596: unauthenticated RCE in Anthropic's MCP Inspector proxy (DNS-rebinding reachable from any website)",
 "class": "responsible_disclosure",
 "attack_surface": "mcp_server",
 "initial_vector": "malicious_website_dns_rebinding_to_localhost",
 "agent_capability_abused": [
  "local_process_spawn",
  "stdio_transport",
  "tool_invocation",
  "local_process_spawning"
 ],
 "target_product": "@modelcontextprotocol/inspector",
 "target_vendor": "Anthropic",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "developer_machine_compromise",
  "arbitrary_code_execution",
  "full_host_compromise"
 ],
 "blast_radius": "any developer machine running MCP Inspector < 0.14.1 while browsing the web; Inspector is the default MCP debugging tool",
 "cve": [
  "CVE-2025-49596"
 ],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI04",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "missing_authentication",
   "dns_rebinding",
   "local_service_exposure",
   "csrf",
   "developer_tooling",
   "zero_zero_zero_zero_day",
   "insecure_defaults"
  ]
 },
 "defense_present": "none - no authentication or origin validation between Inspector client and proxy",
 "defense_bypassed": true,
 "fix_shipped": "@modelcontextprotocol/inspector 0.14.1 (June 2025), added session token auth and origin validation",
 "primary_sources": [
  "https://github.com/advisories/GHSA-7f8r-222p-6f5g",
  "https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596"
 ],
 "verified_quote": "Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.",
 "confidence": "high",
 "notes": "CVSS 9.4 Critical per GitHub Advisory Database. Reported by Oligo Security (Avi Lumelsky). One of the first critical RCEs in the MCP ecosystem. No known in-the-wild exploitation. GHSA-7f8r-222p-6f5g. Also reported as: 'CVE-2025-49596: unauthenticated RCE in Anthropic's MCP Inspector reachable from any website'.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Server-Side Request Forgery via LLM",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape"
 ],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "unauthenticated RCE in the Inspector proxy via DNS rebinding",
 "vector_family": "malicious_component",
 "vector_detail": "malicious_website_dns_rebinding_to_localhost",
 "guardrail_kind": [
  "none"
 ],
 "guardrail_outcome": "not_applicable",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2025-49596"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "mcp_server",
 "model_provider": "anthropic",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "confused_deputy",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "privilege_escalation"
 ],
 "eai_reason": "subcategory: Server-Side Request Forgery via LLM",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI04 (vector_family=malicious_component), ASI03 (eai_category=confused_deputy)",
 "submitted_by": "EAI Internal"
}