Remote Information Disclosure in Geelen MCP-Remote

Executive Summary

CVE-2026-51995 is a Server-Side Request Forgery (SSRF) vulnerability in mcp-remote versions 0.1.32 through 0.1.38. It occurs during OAuth discovery when the software fetches an authorization server endpoint without validating the origin derived from server-controlled metadata. This allows attackers controlling the MCP server to manipulate the origin and probe internal services.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-51995, monitor network traffic for unexpected outbound requests to internal services during OAuth flows. Check logs for blind SSRF attempts by examining requests to /.well-known/oauth-authorization-server from mcp-remote clients. Use tools like tcpdump or Wireshark to capture outbound connections initiated by mcp-remote processes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform blind host discovery and probe internal services reachable from the client host. This may lead to unauthorized access to sensitive systems or information if internal services are exposed. The impact depends on the network configuration and services accessible from the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade mcp-remote to a patched version beyond 0.1.38. Validate authorization-server origins before discovery by implementing strict origin checks. Apply network-level controls to block outbound requests to private IP ranges. Ensure OAuth credentials are stored securely and not in cleartext.

Useful 0 Not Useful 0