---
title: "CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy"
url: https://erroneo.us/security/cve/CVE-2025-49596/
description: "CVE-2025-49596 (@modelcontextprotocol/inspector (npm)): The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-06-13
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-49596"
kev: false
cvss: 9.4
epss: 0.44453
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 44.5% , percentile 99: FIRST’s model estimates a 44.5% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes @modelcontextprotocol/inspector (npm) < 0.14.1, fixed in 0.14.1 . Check your lockfile, including transitive dependencies.
- Editorial verdict: Check exposure. MCP Inspector: Unauthenticated RCE via Browser CSRF — Fixed since June 2025, but Inspector sits in project devDependencies and npx caches, so old copies survive; confirm 0.14.1+ and never run it with auth disabled.

## What it is

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.

## Affected packages

- npm `@modelcontextprotocol/inspector` < 0.14.1 → fixed: 0.14.1

## Affected products (CVE record)

- modelcontextprotocol inspector: < 0.14.1

## Severity

- GitHub_M CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 44.45% probability of exploitation activity in the next 30 days; percentile 99.

## Sources

- [GitHub Advisory GHSA-7f8r-222p-6f5g](https://github.com/advisories/GHSA-7f8r-222p-6f5g)
- [CVE.org record CVE-2025-49596](https://www.cve.org/CVERecord?id=CVE-2025-49596)
- [NVD entry CVE-2025-49596](https://nvd.nist.gov/vuln/detail/CVE-2025-49596)
- [github.com](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g)
- [github.com](https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979)
- [thenewstack.io](https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis)
- [oligo.security](https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596)

---
Source page: https://erroneo.us/security/cve/CVE-2025-49596/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt