CVE-2026-81091 mcp-use CVE debrief

Who should care

Defenders responsible for the security of mcp-use's inspector should assess their exposure and prioritize verifying the affected versions and applying the patch. They should also review the configuration of the inspector and monitor for potential SSRF attacks. Additionally, they should perform a thorough review of the system for any signs of compromise and track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

The vulnerability in mcp-use's inspector allows an attacker to make the server issue requests to internal addresses and read the responses, potentially leading to SSRF attacks and unauthorized access to internal resources.

• Potential SSRF attacks on internal services
• Unauthorized access to internal resources
• Data exfiltration through internal channels
• Compromise of internal systems

Technical summary

The proxy middleware in mcp-use's inspector forwards requests to a destination specified by the caller, without proper validation of the target URL. This allows an attacker to make the server issue requests to addresses reachable only from the host it runs on and read the responses. The vulnerability can be exploited through the X-Target-URL header or the __mcp_target parameter. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

Defensive priority

Defenders should prioritize verifying the affected versions and applying the patch to prevent potential SSRF attacks.

Recommended defensive actions

• Verify the affected versions of mcp-use's inspector
• Apply the patch to update the proxy middleware
• Monitor for potential SSRF attacks
• Review and update the configuration of the inspector
• Perform a thorough review of the system for any signs of compromise
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in mcp-use's inspector, which allows an attacker to make the server issue requests to addresses reachable only from the host it runs on and read the responses. However, the exact affected versions and patch information are not specified. Defenders should verify the affected versions and apply the patch. The vulnerability can be exploited through the X-Target-URL header or the __mcp_target parameter. Limited evidence suggests that the vulnerability may be related to a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.