Unverified50% confidenceFactExact time
MCP Inspector (Anthropic's official debugging tool) once had a zero-click RCE vulnerability with a CVSS of 9.4, requesting localhost from inside the browser via DNS rebinding, and Inspector executed code directly without authentication or origin checks.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/22/2026
First Seen
Valid until: 1/20/2027
Sources
Related Entities
Related Claims
UnverifiedPast vulnerability cases: mcp-remote once passed the authorization URL provided by the server directly to the system shell (CVE-2025-6514, CVSS 9.6); the early MCP Inspector ran an unauthenticated proxy that could execute commands (CVE-2025-49596).74% similarUnverifiedDisclosed MCP vulnerabilities include: argocd-mcp shipped with no authentication at all, Rill's OAuth flow allowed attackers to skip the user consent step, and prompt injection existed in the tool descriptions of multiple MCP servers.69% similarUnverifiedPrompt injection is a security vulnerability unique to LLM applications, where attackers can embed malicious instructions in tool results returned by an MCP server to manipulate agent behavior.69% similarUnverified仅靠扫描器无法检测隐藏在服务器实现代码中的恶意行为，锁定精确版本（如postmark-mcp 1.0.16）仍是必要的安全工作。68% similarUnverifiedThe new oma-security module routes work across source code, skills, MCP, and a restricted web runtime to target-specific engines, preserves forensic evidence, and requires independent verification before confirming a vulnerability or triggering a CI gate; Deepsec remains the default source-scanning engine67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1085484API
curl https://kongchang.com/api/v1/knowledge/claims/1085484MCP
get_claim(id=1085484)