A malicious MCP server could make the mcp-remote bridge request internal addresses

What happened

mcp-remote connects desktop MCP clients that speak only stdio to remote MCP servers and runs their OAuth discovery. From 0.1.32 to 0.1.38 it fetched the resource_metadata URL a remote server supplies in its WWW-Authenticate header with no protocol, host or private-address policy, so an attacker-controlled server can make the user's machine send requests to localhost services, private network addresses or cloud metadata endpoints. The CVE record published on 24 September 2026 scores it CVSS 3.1 9.1.

The researchers demonstrated the request with a localhost-only canary. Their disclosure package of 31 July 2026 records a private report to the upstream project on 17 February and 0.1.38 as the current release at disclosure, and carries six further advisories on mcp-remote's OAuth handling. As of 2 October 2026 no fixed release was confirmed: the NVD record still names only 0.1.32 to 0.1.38 and no fixed version, and whether any later npm release, up to 0.14.3 of 21 September, carries the fix is unconfirmed.