57 matches found
CVE-2025-6514
mcp-remote Connect an MCP Client that only supports local stdio servers to a Remote MCP Server, with auth support: Note: this is a working proof-of-concept but should be considered experimental. Why is this necessary? So far, the majority of MCP servers in the wild are installed locally, using th...
CVE-2026-108716
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...
EUVD-2026-96990
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...
CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...
CVE-2026-108716
The mcp-remote library, versions 0.8.0 through 0.14.3 , is vulnerable to a cleartext transmission flaw within the authorizeWithDeviceCode function. The root cause is the failure to enforce HTTPS endpoints when handling device authorization and token endpoints. If these endpoints are non-loopback ...
CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...
PT-2026-110119
Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.8.0 through 0.14.3 Description The software contains a cleartext transmission issue within the authorizeWithDeviceCode function. This occurs when client secrets are sent and tokens are received without the enforcement of...
CVE-2026-108716: Cleartext Transmission of Sensitive Information
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...
CVE-2026-51995
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...
CVE-2026-51996
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...
CVE-2026-51997
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open functions...
CVE-2026-52001
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...
CVE-2026-51994
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery SSRF via the resourcemetadata URL extracted from a remote MCP server's WWW-Authenticate header...
PT-2026-97822
Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.1.32 through 0.1.38 Description The software is subject to Server-Side Request Forgery SSRF, a flaw that allows a server to make requests to an unintended location. This occurs because the application trusts and fetches t...
PT-2026-97823
Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.32 through 0.1.38 Description A remote attacker can obtain sensitive information, including internal configuration and values, by triggering metadata processing. The issue resides in the authorization server...
CVE-2026-51996
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...
CVE-2026-51995: Exposure of Sensitive Information to an Unauthorized Actor
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...
CVE-2026-51997
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open functions...