Unrated severityNVD Advisory· Published Sep 24, 2026

CVE-2026-51994

Description

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Punkpeye/mcp-remotellm-create
Range: 0.1.32 - 0.1.38
Playb0t/mcp-remote-oauth-securityllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/geelen/mcp-remote/security/advisoriesnvd
github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-01-resource-metadata-ssrf.mdnvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000