AIKIDO-2026-632017

@modelcontextprotocol/inspector-server is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE Published Jul 20, 2026

Medium Risk

This Affects:

@modelcontextprotocol/inspector-server

0.21.2 - 0.22.0

Fixed in 1.0.0

Are you affected? Scan for Free

TL;DR

The Inspector's server-side /fetch proxy forwards client-supplied http/https URLs to fetch() without restricting the target address. A connected MCP server can advertise OAuth discovery or token endpoints that resolve to link-local or cloud-metadata addresses such as 169.254.169.254, causing the proxy to request them and return the response. When the proxy runs on a cloud host this can expose instance metadata and IAM credentials, and redirects from an allowed host into a blocked address were not re-validated. The fix resolves the target host, blocks link-local/cloud-metadata ranges including IPv4-mapped IPv6 forms, and re-validates every redirect hop, returning 403 for blocked targets.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run the Inspector proxy where it can reach internal or cloud-metadata addresses and connect it to an untrusted MCP server.