CVE-2025-49596: MCP Inspector Missing Authentication Remote Code Execution Vulnerability
9.4
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @modelcontextprotocol/inspector | npm | < 0.14.1 | 0.14.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability (CVE-2025-49596 / GHSA-7f8r-222p-6f5g) in MCP Inspector versions prior to 0.14.1 stems from a lack of authentication on several critical API endpoints in the proxy server (server/src/index.ts). This allowed unauthenticated users to interact with these endpoints, potentially leading to remote code execution, as highlighted by the ability to launch MCP commands over stdio.
The patch (commit 50df0e1ec488f3983740b4d28d2a968f12eb8979) addresses this by introducing two new middleware functions: originValidationMiddleware (for DNS rebinding protection) and authMiddleware (for session token-based authentication).
These middlewares are now applied to the following Express.js route handlers, which were previously unprotected:
app.get("/mcp"),app.post("/mcp"),app.delete("/mcp"): These endpoints handle core MCP operations. Lack of authentication could allow unauthorized control over MCP processes.app.get("/stdio"): This endpoint is explicitly mentioned in the vulnerability description as a vector for remote code execution by launching MCP commands. Before the patch, it was directly accessible.app.get("/sse"): Handles Server-Sent Events, potentially exposing sensitive real-time data or allowing manipulation if unauthenticated.app.post("/message"): Likely handles message passing to the MCP server; lack of authentication could allow unauthorized message injection.app.get("/config"): Exposes server configuration details, which could be sensitive.
By adding authentication to these route handlers, the patch ensures that only authorized clients (presenting a valid session token) can interact with these sensitive functionalities. The functions themselves (the anonymous async functions passed to app.get, app.post, etc.) are the points where unauthenticated requests were processed before the patch. During exploitation, a profiler would show calls to these route handlers within the Express.js framework when an unauthenticated request hits one of these endpoints.