← Database

CVE-2026-51994

N/A CVSS: N/A Published: 2026-09-24 Modified: 2026-09-24

Description

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header

Affected Platforms

Unknown

Weakness Type

Unknown

References