CVE-2026-51996

Deferred Deferred - Pending Action

Remote Code Execution in geelen mcp-remote

Publication date: 2026-09-24

Last updated on: 2026-09-29

Assigner: MITRE

Description

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-29

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-51996

EUVD

EUVD-2026-86019

Affected Vendors & Products

Vendor	Product	Version / Range
geelen	mcp-remote	From 0.1.16 (inc) to 0.1.38 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-328	The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability involves a remote attacker being able to execute arbitrary code due to a flaw in the getServerUrlHash function within src/lib/utils.ts in geelen mcp-remote versions 0.1.16 through 0.1.38.

Detection Guidance

The provided CVE context does not include specific detection methods or commands for identifying this vulnerability on a network or system. The issue involves arbitrary code execution via the getServerUrlHash function in geelen mcp-remote versions 0.1.16 through 0.1.38.

Impact Analysis

A remote attacker could exploit this to run malicious code on your system if you are using affected versions of geelen mcp-remote. This could lead to unauthorized access, data theft, or further compromise of your environment.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves arbitrary code execution in mcp-remote, which could potentially lead to unauthorized access or data breaches. However, without explicit details on data handling or security controls, its compliance impact remains unclear.

Mitigation Strategies

Update mcp-remote to a version that replaces MD5 with SHA-256 for token namespace separation. Ensure the full server identity and configuration are included in the namespace to prevent ambiguity.

Hi! I’m here to help you understand CVE-2026-51996. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70