CVE-2026-81091

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-81091

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81091.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-81091

Aliases

GHSA-f2jg-rm2x-hc5p

Published

2026-08-27T14:50:32.568Z

Modified

2026-08-29T03:30:58.152872479Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

Details

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the _mcptarget parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81091.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/mcp-use/mcp-use

Affected ranges

Type

GIT

Repo

https://github.com/mcp-use/mcp-use

Events

Introduced

Last affected

2c8940263e4a0c118c6f584af7dbd7afdae09fcf

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.2"
        }
    ]
}

Affected versions

@mcp-use/agent@2.*

@mcp-use/agent@2.0.0

@mcp-use/agent@2.0.1

@mcp-use/agent@2.0.2

@mcp-use/agent@2.0.3

@mcp-use/agent@2.0.4

@mcp-use/agent@2.0.5

@mcp-use/agent@2.0.6

@mcp-use/agent@2.0.7

@mcp-use/agent@2.0.8

@mcp-use/agent@2.0.9

@mcp-use/cli@2.*

@mcp-use/cli@2.1.12

@mcp-use/cli@2.5.6

@mcp-use/cli@3.*

@mcp-use/cli@3.3.2

@mcp-use/cli@3.4.0

@mcp-use/cli@3.4.1

@mcp-use/cli@3.4.2

@mcp-use/cli@3.5.0

@mcp-use/cli@3.5.1

@mcp-use/cli@3.5.2

@mcp-use/cli@3.6.0

@mcp-use/cli@3.6.1

@mcp-use/cli@3.6.2

@mcp-use/cli@3.6.3

@mcp-use/cli@3.6.4

@mcp-use/cli@4.*

@mcp-use/cli@4.0.0

@mcp-use/cli@4.0.1

@mcp-use/cli@4.1.0

@mcp-use/cli@4.1.1

@mcp-use/cli@4.1.2

@mcp-use/cli@4.1.3

@mcp-use/cli@4.1.4

@mcp-use/cli@4.1.5

@mcp-use/cli@4.1.6

@mcp-use/client@2.*

@mcp-use/client@2.0.0

@mcp-use/client@2.0.1

@mcp-use/client@2.1.0

@mcp-use/client@2.1.1

@mcp-use/client@2.1.2

@mcp-use/client@2.1.3

@mcp-use/client@2.1.4

@mcp-use/client@2.1.5

@mcp-use/client@2.2.0

@mcp-use/inspector@0.*

@mcp-use/inspector@0.12.6

@mcp-use/inspector@0.4.0

@mcp-use/inspector@10.*

@mcp-use/inspector@10.0.0

@mcp-use/inspector@10.0.1

@mcp-use/inspector@11.*

@mcp-use/inspector@11.0.0

@mcp-use/inspector@12.*

@mcp-use/inspector@12.0.0

@mcp-use/inspector@12.0.1

@mcp-use/inspector@12.0.2

@mcp-use/inspector@12.0.3

@mcp-use/inspector@20.*

@mcp-use/inspector@20.0.0

@mcp-use/inspector@20.0.1

@mcp-use/inspector@20.0.3

@mcp-use/inspector@20.0.4

@mcp-use/inspector@20.1.0

@mcp-use/inspector@20.1.1

@mcp-use/inspector@20.2.0

@mcp-use/inspector@20.2.1

@mcp-use/inspector@20.2.2

@mcp-use/inspector@20.2.3

@mcp-use/inspector@20.2.4

@mcp-use/inspector@20.2.5

@mcp-use/inspector@20.3.0

@mcp-use/inspector@20.3.1

@mcp-use/inspector@8.*

@mcp-use/inspector@8.0.0

@mcp-use/inspector@8.0.1

@mcp-use/inspector@8.0.2

@mcp-use/inspector@9.*

@mcp-use/inspector@9.0.0

@mcp-use/inspector@9.0.1

@mcp-use/tunnel@0.*

@mcp-use/tunnel@0.2.0

create-mcp-use-app@0.*

create-mcp-use-app@0.14.15

create-mcp-use-app@0.14.16

create-mcp-use-app@0.14.17

create-mcp-use-app@0.4.0

create-mcp-use-app@0.8.0

create-mcp-use-app@2.*

create-mcp-use-app@2.0.0

create-mcp-use-app@2.0.1

create-mcp-use-app@2.0.2

create-mcp-use-app@2.0.3

create-mcp-use-app@2.0.4

mcp-use@1.*

mcp-use@1.1.0

mcp-use@1.10.6

mcp-use@1.30.0

mcp-use@1.30.1

mcp-use@1.30.2

mcp-use@1.31.0

mcp-use@1.31.1

mcp-use@1.32.0

mcp-use@1.32.1

mcp-use@1.33.0

mcp-use@1.34.0

mcp-use@1.34.1

mcp-use@1.34.2

mcp-use@1.34.3

mcp-use@2.*

mcp-use@2.0.0

mcp-use@2.0.1

mcp-use@2.0.3

mcp-use@2.0.4

mcp-use@2.1.0

mcp-use@2.1.1

mcp-use@2.2.0

mcp-use@2.2.1

mcp-use@2.2.2

mcp-use@2.2.3

mcp-use@2.2.4

mcp-use@2.3.0

mcp-use@2.3.1

mcp-use@2.3.2

python-v1.*

python-v1.3.13

python-v1.3.14

python-v1.4.0

python-v1.4.1

python-v1.4.2

python-v1.5.0

python-v1.5.1

python-v1.5.2

python-v1.6.0

python-v1.7.0

v1.*

v1.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81091.json"