{
  "schema_version": "1.6.0",
  "id": "ACVE-2025-0001",
  "aliases": [
    "CVE-2025-49596"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-20T02:45:17.577Z",
  "summary": "MCP Inspector can bypass local authentication and rebind localhost",
  "details": "## What the vulnerability is\n\nMCP Inspector is a developer tool that places a local proxy between an MCP client and an MCP server. The referenced advisory describes a flaw in versions before `0.14.1` where local authentication could be bypassed and browser-origin behavior could be combined with localhost rebinding. That can let an unintended requester reach the Inspector's MCP-facing operations.\n\n## Which configuration is exposed\n\nThe exposed combination is any configuration that launches or installs `@modelcontextprotocol/inspector` as an MCP server. ACVE's matcher encodes only the server package identity `pkg:npm/@modelcontextprotocol/inspector`; it does not require a particular harness, transport, host binding, or permission mode. Thus the finding applies when the Inspector package is present in `mcpServers`, including a development setup where it is started through a package runner.\n\n## How ACVE detects it\n\nACVE reads `mcpServers[].package` and matches the Inspector package PURL. It does not read `mcpServers[].resolvedVersion`, determine whether the Inspector proxy is bound to loopback, or prove that authentication is disabled. A package launched through `npx` may have no resolved version in the lockfile, so the finding is deliberately broad and should be treated as a possible match until the running package is checked.\n\n## Fix\n\n1. Upgrade the Inspector package to `0.14.1` or later.\n2. Re-check the launch configuration and keep the Inspector proxy limited to the intended local developer boundary; do not expose it as a network service.\n\nThe package match is useful for development environments as well as production-like integrations because Inspector is itself the component being launched.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@modelcontextprotocol/inspector"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "MCP",
        "name": "pkg:npm/@modelcontextprotocol/inspector"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2025-49596"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "published",
      "vulnClasses": [
        "auth-bypass",
        "dns-rebinding-localhost"
      ],
      "cwe": [
        "CWE-306",
        "CWE-350"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI03 Identity and Privilege Abuse"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "some": "mcpServers",
        "where": {
          "field": "package",
          "op": "eq",
          "value": "pkg:npm/@modelcontextprotocol/inspector"
        }
      },
      "fix": {
        "summary": "Upgrade MCP Inspector to 0.14.1 or later and keep its proxy local.",
        "actions": [
          {
            "type": "upgrade",
            "target": "mcp:pkg:npm/@modelcontextprotocol/inspector",
            "to": "0.14.1",
            "why": "Use the fixed release."
          }
        ]
      },
      "exposure": "network",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:20Z",
          "found": true,
          "aliasesConfirmed": [
            "CVE-2025-49596",
            "GHSA-7f8r-222p-6f5g"
          ],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": [
            {
              "type": "CVSS_V4",
              "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
            }
          ]
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:20Z",
          "found": true,
          "cvss": 9.4,
          "published": "2025-06-13T20:15:23.133"
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:20Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:20Z",
          "confirmed": [
            "npm:@modelcontextprotocol/inspector@0.14.1"
          ],
          "missing": []
        }
      },
      "validatedBy": [
        {
          "who": "Mark Pickering (PickBits) via Claude Code session 01YR6ri2tM3jU9vdQNe9R5pw",
          "date": "2026-09-20",
          "method": "vendor-advisory",
          "evidence": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596",
          "note": "MCP Inspector < 0.14.1; NVD CVSS 9.4 confirmed by grounding."
        }
      ]
    }
  }
}