---
title: "MCP Inspector: Unauthenticated RCE via Browser CSRF"
url: https://erroneo.us/security/briefs/mcp-inspector-unauthenticated-rce/
description: "Anthropic's MCP Inspector before 0.14.1 let any web page run commands on a developer's machine (CVE-2025-49596, CVSS 9.4). Upgrade to 0.14.1+, check old repos."
type: security-brief
section: "Security Digest"
date_published: 2025-06-13
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-49596"]
severity: "critical"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# MCP Inspector: Unauthenticated RCE via Browser CSRF

**Verdict: Check exposure.** Fixed since June 2025, but Inspector sits in project devDependencies and npx caches, so old copies survive; confirm 0.14.1+ and never run it with auth disabled.

- **Who must act:** MCP server developers who run MCP Inspector from an old lockfile, a global install, or a container below 0.14.1, or who run any version with DANGEROUSLY_OMIT_AUTH or HOST=0.0.0.0.
- **Who can relax:** People who never run MCP Inspector, and those on 0.14.1 or later with the default session token and localhost binding.
- **Affected:** @modelcontextprotocol/inspector versions below 0.14.1
- **Fixed:** @modelcontextprotocol/inspector 0.14.1
- **CVEs:** CVE-2025-49596
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Check versions: `npm ls -g @modelcontextprotocol/inspector` and `npm ls @modelcontextprotocol/inspector` in each MCP server project.
2. Upgrade: `npm install -g "@modelcontextprotocol/inspector@^0.14.1"` (or later), and bump devDependencies and lockfiles.
3. Run it via `npx @modelcontextprotocol/inspector@latest` rather than relying on a cached copy.
4. Keep the default session token on; never set DANGEROUSLY_OMIT_AUTH, and don't set HOST=0.0.0.0 outside an isolated network.
5. Make sure the proxy port (6277 by default) is not reachable from the internet or shared networks.

### How to check if you are affected

- Search lockfiles across repos for @modelcontextprotocol/inspector versions below 0.14.1.
- Scan for listeners on TCP 6277/6274 on developer hosts and any cloud VMs or containers.
- If an old Inspector ran while you browsed the web, check for unexpected child processes of the Inspector's node process and for unfamiliar outbound connections.

## What happened

MCP Inspector is Anthropic's official developer tool for testing and debugging Model Context Protocol servers. It has two parts: a browser UI and a local proxy that can launch MCP servers as subprocesses over stdio. Before version 0.14.1 there was [no authentication between the client and the proxy](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g), so anyone who could send it a request could make it launch an arbitrary command. The advisory and [CVE-2025-49596](https://cveawg.mitre.org/api/cve/CVE-2025-49596) were published on June 13, 2025, rated CVSS 4.0 9.4 (critical), and credited Rémy Marot of Tenable.

[Oligo Security's June 27 write-up](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596) showed why "local only" didn't help. A malicious public web page could send a cross-site request from the victim's browser to the proxy on port 6277 at `0.0.0.0`, a browser quirk Oligo calls "0.0.0.0-day." The request hit the `/sse` endpoint with `transportType=stdio` and attacker-chosen `command` and `args`. The proxy also didn't check Origin or Host headers, so DNS rebinding worked too. Visiting a web page while the Inspector was running was enough for code execution.

## Who is affected

Anyone who ran `@modelcontextprotocol/inspector` below 0.14.1. In practice that means MCP server authors and people trying out MCP servers, usually with `npx @modelcontextprotocol/inspector`. The 0.14.1 release was [published on June 13](https://github.com/modelcontextprotocol/inspector/releases/tag/0.14.1). Oligo also reports finding Inspector instances exposed directly to the internet, without giving a count. Those were exploitable with no browser trick at all.

## Do you really need to act?

The impact was severe: full code execution as the developer, on machines that hold source code, cloud credentials and API keys. Exploitation needed only one precondition, an old Inspector running while you browsed the web. A public PoC exists, and other researchers had already reported the bug on March 26, 2025. However, neither the advisory nor Oligo reports in-the-wild exploitation, and the CVE is not in CISA KEV.

As of October 2026, the fix is old news for anyone who launches the tool with `@latest`. The leftover risk is old copies pinned in a project's devDependencies, global installs, and Docker images. There is also a newer footgun: the fix added an opt-out, and turning it on brings the original vulnerability back.

## What to do now

1. Check versions globally and per project: `npm ls -g @modelcontextprotocol/inspector` and `npm ls @modelcontextprotocol/inspector`.
2. Upgrade with `npm install -g "@modelcontextprotocol/inspector@^0.14.1"` (or the current version), and update devDependencies and lockfiles.
3. Prefer `npx @modelcontextprotocol/inspector@latest` so you don't run a stale cached build.
4. Keep the protections in the [fix commit](https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979) switched on: a random session token required as a Bearer token, Origin checks (extended only via `ALLOWED_ORIGINS`), and binding to 127.0.0.1. Don't set `DANGEROUSLY_OMIT_AUTH`, and don't set `HOST=0.0.0.0` on untrusted networks.
5. Block port 6277 from outside the host on any VM or container that runs the Inspector.

## How to tell if you were hit

No indicators of compromise have been published, and Oligo offers only version checking. To hunt: list every machine that ran a pre-0.14.1 Inspector, check whether ports 6277/6274 were ever exposed beyond localhost, and look for unexpected child processes of the Inspector's node process, such as shells or curl/wget. If you find signs, rotate credentials that were reachable from that machine (cloud keys, Git tokens, LLM API keys).

## Timeline

- Mar 26, 2025 — Another researcher reports the vulnerability to Anthropic (per Oligo).
- Apr 18, 2025 — Oligo reports it to Anthropic with an RCE proof of concept.
- Jun 13, 2025 — 0.14.1 released; GHSA-7f8r-222p-6f5g and CVE-2025-49596 published.
- Jun 27, 2025 — Oligo publishes its write-up of the browser-based attack chain.

## Sources

1. [GitHub — GHSA-7f8r-222p-6f5g: Inspector proxy server vulnerabilities](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g)
2. [CVE Program — CVE-2025-49596 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-49596)
3. [Oligo Security — Critical RCE Vulnerability in Anthropic MCP Inspector (CVE-2025-49596)](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)
4. [GitHub — Inspector commit 50df0e1: Address inspector security vulnerabilities](https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979)
5. [GitHub — MCP Inspector release 0.14.1](https://github.com/modelcontextprotocol/inspector/releases/tag/0.14.1)

---
Source page: https://erroneo.us/security/briefs/mcp-inspector-unauthenticated-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt