# CVE-2025-49596: MCP Inspector - Authentication Bypass

> Live exploitation tracking for CVE-2025-49596 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-49596

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.4
- **Public exploit available:** Yes
- **Affected products:** ModelContextProtocol.io MCP Inspector
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** ai_mcp

## Description

The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. Users should immediately upgrade to version 0.14.1 or later to address these vulnerabilities.

## CrowdSec analysis

[CVE-2025-49596](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-49596) is a critical vulnerability in MCP Inspector versions prior to 0.14.1 that allows unauthenticated remote code execution due to missing authentication between the Inspector client and proxy. Attackers can exploit this flaw to send unauthorized requests and execute arbitrary MCP commands, potentially leading to full system compromise. Immediate upgrades to version 0.14.1 or later are strongly recommended to mitigate this severe risk.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-49596 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit unauthenticated access to the `/sse` endpoint with parameters like `transportType=stdio` and `command=echo` to remotely execute arbitrary MCP commands on vulnerable MCP Inspector instances. These requests do not require authentication and can be used to gain code execution on affected servers.

## Timeline

- 2025-06-13: CVE Published. CVE-2025-49596 is published to NVD.
- 2025-09-24: Rule Released. CrowdSec releases a rule to detect CVE-2025-49596 exploitation attempts against the CrowdSec Network.
- 2025-10-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-49596 for the first time.

## References

- https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-7f8r-222p-6f5g
- https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
- https://thenewstack.io/mcp-vulnerability-exposes-the-ai-untrusted-code-crisis
- https://github.com/modelcontextprotocol/inspector/commit/50df0e1ec488f3983740b4d28d2a968f12eb8979
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-49596.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-49596) follows observed exploitation activity for CVE-2025-49596. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.