Unknown nvd · CVE-2026-51994

CVE-2026-51994: mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata

Published Sep 24, 2026

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header

SSRF Agentic / MCP

Affected AI Products

mcp server

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.