critical9.1
CVE-2026-51994
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server…
Impact
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header
Affected products
| Product | Affected versions |
|---|---|
| Mcp-Remote Versions 0.1.32 | through 0.1.38 |
Versions were read from the advisory text. No structured product data has been published for this record yet.