Disclosed vulnerability
CVE-2025-49596: unauthenticated RCE in Anthropic's MCP Inspector proxy (DNS-rebinding reachable from any website)
AIR-2025-0041 AIR record · 2025-06-anthropic-mcp-inspector-rce
From the supporting source
Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio.github.com
The record
Disclosed
2025-06-13
Vendor
Anthropic
Product
@modelcontextprotocol/inspector
Risk domain
Access control and permissions › Confused deputy
Also touches
Privilege escalation
System type
Generative model
Who acted
AI was the target — unauthenticated RCE in the Inspector proxy via DNS rebinding
Attack surface
MCP server
Autonomy level
Assistant
Initial vector
Malicious website dns rebinding to localhost
Impact type
Remote code execution, Developer machine compromise, Arbitrary code execution, Full host compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Validate delegation chains; Use signed attestations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any developer machine running MCP Inspector < 0.14.1 while browsing the web; Inspector is the default MCP debugging tool
Capability abused
Defense & remediation
Recorded defense
none - no authentication or origin validation between Inspector client and proxy
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
@modelcontextprotocol/inspector 0.14.1 (June 2025), added session token auth and origin validation
Taxonomy & references
Curator notes
CVSS 9.4 Critical per GitHub Advisory Database. Reported by Oligo Security (Avi Lumelsky). One of the first critical RCEs in the MCP ecosystem. No known in-the-wild exploitation. GHSA-7f8r-222p-6f5g. Also reported as: 'CVE-2025-49596: unauthenticated RCE in Anthropic's MCP Inspector reachable from any website'.
Supporting sources
Cite as
Enkrypt AI. "CVE-2025-49596: unauthenticated RCE in Anthropic's MCP Inspector proxy (DNS-rebinding reachable from any website)". AIR, AIR-2025-0041. https://agentincident.vercel.app/i/AIR-2025-0041/ (accessed 2026-10-19).