AI developer toolsBriefPublic record
MCP Inspector RCE (CVE-2025-49596)
Unauthenticated localhost proxy plus the 0.0.0.0-day browser bug led to RCE from a website.
- Disclosed
What happened
- Unauthenticated localhost proxy plus the 0.0.0.0-day browser bug led to RCE from a website. Fixed: 0.14.1.
Live scores
Live scores
CVE-2025-49596- EPSS
- 0.445
likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Not listed
Sources
- https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.