Vibe Coding
mcp-use's Inspector Proxied to Any Destination Named in a Header (CVE-2026-81091, 8.7)
`mountMcpProxy` in `libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts` read the forwarding target from the `X-Target-URL` header or the `__mcp_target` parameter and proxied to it without inspecting the destination, giving full SSRF from the developer's machine. The same run's CVE-2026-81093 (8.7) is the same shape in a different place: `get_html_skeleton.ts` validated its `url` argument with `isValidHttpUrl`, which only confirmed an http/https scheme and that the string parsed. Scheme checking is not an SSRF guard.
Source
↳ Follow the thread