Anthropic MCP Inspector: CVE-2025-49596: Vulnerability Disclosure
ID: b57607e7-f6a9-5618-ba8a-25b1325dc104
STIX ID: report--b57607e7-f6a9-5618-ba8a-25b1325dc104
Feed Name: Recorded Future Blog
Threat Score
Recorded Future’s Insikt Group details CVE-2025-49596, a critical unauthenticated RCE in Anthropic’s MCP Inspector proxy (MCPP) that permits execution of arbitrary stdio commands from a browser via CSRF or DNS rebinding; the report includes a Nuclei detection template, recommends upgrading to MCP Inspector 0.14.1 which enforces session tokens and origin checks, and notes roughly 560 potentially exposed instances on Shodan.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.