MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)
Anthropic's MCP Inspector tool, used by developers to debug MCP servers, ran an unauthenticated network proxy that would spawn arbitrary local commands just because a browser tab asked it to. Any malicious website the developer visited could trigger this while the Inspector was running, with no login or user interaction beyond loading the page.
How the attack works
The Inspector listens on 0.0.0.0:6277 and exposes an /sse endpoint that starts an MCP server over stdio using command and argument values taken straight from the URL's query string. It performs no authentication and no check on where the request came from. A malicious public webpage (or an attacker using DNS rebinding to make a domain resolve to 127.0.0.1) can send a cross-site request to that endpoint with transportType=stdio and a command parameter, and the Inspector executes it as an OS command on the developer's machine. No clicking, credentials, or local access are required beyond having the Inspector running and visiting the page.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 58e94ffc-dd48-4e8a-b313-3b54339bc0d8
- Severity
- Critical
- CVEs
- CVE-2025-49596
Why it matters
Any developer running a vulnerable MCP Inspector (below 0.14.1) can have their machine remotely commanded by a page they merely open in a browser, giving an attacker code execution with the developer's local privileges — a foothold for credential theft, source code access, or further lateral movement.
What you can do
- →Upgrade MCP Inspector to version 0.14.1 or later, which adds session-token authentication and Origin verification.
- →Do not run the Inspector proxy on a network-reachable interface (0.0.0.0); bind it to localhost only and avoid exposing port 6277.
- →If you must run an older version, avoid browsing untrusted sites while the Inspector is active, and consider a local firewall rule blocking inbound connections to port 6277 from anything but the Inspector's own process.
- →Monitor for requests to the /sse endpoint on port 6277 that include transportType=stdio combined with a command parameter, especially from cross-site or DNS-rebinding sources.
Known benign look-alikes
- Legitimate local MCP Inspector usage after the 0.14.1 fix carries a MCP_PROXY_AUTH_TOKEN / session token header and is initiated same-origin from the Inspector UI, not via a cross-site fetch string embedding command=. Documentation of the Inspector's own URL scheme without a command= parameter (e.g. a plain /sse connect) does not match.
- Advisory, patch-note, and research text that merely names CVE-2025-49596, the :6277 port, or the /sse endpoint without carrying a live transportType=stdio + command= request string does not match.
- Generic references to Server-Sent Events (/sse) endpoints on unrelated services that do not combine the :6277 Inspector proxy port with a stdio command parameter.