SSRF in Mcp-Use
CVE-2026-81091
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (38.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 38.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001
Affected products
Weakness classification (CWE)
References
- github.com/mcp-use/mcp-use (product)
- github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p (vendor-advisory)
- www.vulncheck.com/advisories/mcp-use-inspector-proxy-server-side-request-forger… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-81091?
- CVE-2026-81091 is a high-severity vulnerability in Mcp-Use, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.6/10. Published 2026-08-27.
- How severe is CVE-2026-81091?
- High severity. CVSS v3 base score is 8.6 out of 10.