---
id: CVE-2026-81091
title: >-
  The proxy middleware in mcp-use's inspector forwards requests to a destination
  the caller names
summary: >-
  The proxy middleware in mcp-use's inspector forwards requests to a destination
  the caller names. mountMcpProxy in
  libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the
  target from the X-Target-URL header or the _…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-27'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:43.387'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81091'
references:
  - url: 'https://github.com/mcp-use/mcp-use'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mcp-use-inspector-proxy-server-side-request-forgery-via-caller-supplied-target-url
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00342
epssPercentile: 0.27779
ingestedAt: '2026-09-23T17:28:14.805Z'
---

## Overview

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.