CVE-2025-49596

CVE-2025-49596 is a missing-authentication flaw (CWE-306) in the MCP Inspector, a developer tool for testing and debugging Model Context Protocol (MCP) servers: the Inspector's proxy component accepts unauthenticated requests from the client, which allows unauthenticated requests to launch MCP commands over stdio. An attacker who can reach the proxy while a developer is running the Inspector (CVSS 4.0 indicates network attack vector with user interaction required, consistent with a malicious page or request reaching the developer's machine) can trigger these command launches without any credentials. Successful exploitation yields remote code execution on the developer's machine with the privileges of the Inspector process, which is why the flaw is rated 9.4 (critical) on the CVSS 4.0 scale with high impact across confidentiality, integrity, and availability. Affected users are developers running any MCP Inspector version below 0.14.1 on their workstations; this is a developer-tool flaw, not a production-server flaw, so only machines actively running the tool are exposed at any given time. No public proof-of-concept or confirmed in-the-wild exploitation is currently known and the issue is not yet in CISA's KEV catalog, but EPSS assigns a 42.7% probability of exploitation within 30 days (99th percentile), indicating high near-term risk.

What to do: Upgrade MCP Inspector to version 0.14.1 or later immediately on all developer machines. Until upgraded, do not keep the Inspector or its proxy component running while browsing untrusted websites or handling untrusted content, and shut it down when not actively debugging. Audit developer workstations and CI images for running or installed Inspector instances and verify the installed version is 0.14.1 or later.