Critical RCE in MCP Inspector Exposes AI Devs to Web-Based Exploits (CVE-2025-49596)

A critical vulnerability—CVE-2025-49596—affected the AI developer ecosystem in June 2025, when Oligo Security Research disclosed a severe Remote Code Execution (RCE) flaw in the MCP Inspector, a core debugging tool within Anthropic’s Model Context Protocol (MCP) framework. This flaw, rated 9.4 on the CVSS scale, could allow websites to take over a developer’s machine via nothing more than a browser tab.

“This is one of the first critical RCEs in Anthropic’s MCP ecosystem, exposing a new class of browser-based attacks against AI developer tools,” warns Oligo Security in their advisory.

The Model Context Protocol (MCP) is an open-source framework designed to connect tools and agents—think of it as the glue behind intelligent collaboration between AI systems. Supported by heavyweights like Microsoft, OpenAI, and Google, MCP servers are widely deployed across local dev machines and cloud environments, usually in Python or JavaScript.

The MCP Inspector, developed by Anthropic, helps developers debug and test MCP-based applications. It includes:

• A React-based client for interaction
• A Node.js-based proxy to bridge the UI to back-end servers

Unfortunately, this seemingly harmless tool was running wide open—without authentication, encryption, or access controls by default.

“The MCP Inspector tool runs by default… with a default setup that does not include sufficient security measures like authentication or encryption,” Oligo notes. “This misconfiguration creates a significant attack surface.”

Here’s how the exploit works:

1. A developer runs the MCP Inspector on their machine using the standard mcp dev command.
2. The proxy server listens on 0.0.0.0:6277 (essentially localhost, but accessible to other network devices).
3. A malicious website embeds a JavaScript payload to send a request to the MCP Inspector.
4. That request can execute any command on the host machine—installing backdoors, accessing files, or even launching reverse shells.

This is made possible by a 19-year-old vulnerability in browsers known as the “0.0.0.0-day”, which allows websites to communicate with localhost services.

“One of the most serious concerns with this vulnerability is the Cross-Site Request Forgery (CSRF) attacks from public websites… resulting in remote code execution on the MCP developer/user machine—even if it is listening on localhost.”

Oligo issues an example: imagine reading a tutorial or blog post that secretly contains JavaScript designed to ping http://0.0.0.0:6277/sse?command=…, and before you know it, your machine is compromised.

A sample payload from the report:

<script>
fetch("http://0.0.0.0:6277/sse?transportType=stdio&command=touch&args=%2Ftmp%2Fexploited-from-the-browser", {
    "headers": {
        "accept": "*/*",
        "accept-language": "en-US,en;q=0.9", 
        "cache-control": "no-cache",
        "pragma": "no-cache"
    },
    "referrer": "http://127.0.0.1:6274/",
    "referrerPolicy": "strict-origin-when-cross-origin",
    "body": null,
    "method": "GET",
    "mode": "no-cors",
    "credentials": "omit"
})
</script>

“The attacker gains full access to the developer’s machine, compromising the integrity of their system and any data it contains, opening reverse shells – all from a public web page.”

Oligo also found several public-facing instances of MCP Inspector online, fingerprintable via unique HTTP headers. These systems are exposed to full remote command execution—no browser needed.

“We managed to identify MCP Inspector instances that are exposed to the internet and are in immediate risk of remote code execution.”

Anthropic’s security team responded quickly, and as of version 0.14.1, MCP Inspector now includes:

• Session token-based authentication (like Jupyter notebooks)
• Origin header checks to prevent CSRF
• Documentation updates emphasizing localhost-only usage

“The session token makes sure only authorized clients can use the inspector – mitigating CSRF attacks,” the researchers confirm.

Related Posts:

• AirBorne Exploits: Zero-Click Wormable RCE Hits Apple & IoT Devices
• Google Gemini to Support Anthropic’s Model Context Protocol (MCP)
• Cybersecurity Concerns Loom Over Drinking Water Systems, Says EPA Inspector General Report
• A New Era for Windows: Microsoft’s Protocol Transforms OS into AI Agent Platform