CVE-2026-51994
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header
- Published Sep 24, 2026
- CVSS 9.1 critical
- 0.4% chance of exploitation in the next 30 days (EPSS)