mcp-remote OAuth Trust-Boundary Security Advisories

Five published CVE records, all scored by CISA-ADP, up to 9.8 Critical.
The current published CLI, 0.15.1 of 14 October 2026, still follows the server-selected request paths of CVE-2026-51994 and CVE-2026-51995.

Research dossier, 9 October 2026 · 0.15.1 follow-up, 15 October 2026 · MCP Host Matrix, 25 October 2026 · Advisory index · Impact ledger

Executive summary

mcp-remote bridges stdio-only MCP clients to remote MCP servers and runs OAuth discovery on their behalf. That makes remote-server metadata a security boundary: a server-selected URL, redirect or credential destination must not become trusted because it appeared during discovery.

Seven advisories document the review of the release current at disclosure, 0.1.38: two localhost-canary reproductions, three bounded source reviews, two hardening records corrected in v1.0.1. The private report went to the maintainer on 17 February 2026; the public disclosure followed on 31 July after no acknowledgement; MITRE published five CVE records on 24 September 2026, and CISA-ADP scored all five. On 9 October 2026 the published 0.14.3 CLI, run in full in three local stdio scenarios, reproduced the F-01 / F-02 request path, HTTP 302 redirect included, and the discovery helpers executed in all 58 stable releases from 0.1.32 to 0.14.3. Between the private report and 7 October 2026 npm served 19,060,907 downloads of the package. No fixed release has been stated. On 14 October 2026 the maintainer published four releases, 0.14.4 through 0.15.1; none of them names a record. On 15 October the 9 October procedure was repeated on 0.15.1. It recorded the same F-01 / F-02 request paths. In the full trace it also recorded a token request, carrying an Authorization header, to the authorization server named by the server's own metadata, as it does in 0.14.3 runs under the same environment.

Methodology · Disclosure timeline · Corrections · Trust-boundary map

Advisory index

The F-* identifiers are stable research IDs. Ranges are those of the original advisories; scores are the published CISA-ADP CVSS 3.1 assessments, reported as published. The research asserts no numeric score of its own, and its evidence classes stay separate from the official severity.

Advisory	CVE record	CISA-ADP	Relevant versions	Evidence
F-01 · SSRF via unvalidated resource_metadata URL	CVE-2026-51994	9.1 Critical	0.1.32–0.1.38	Local PoC, reverified
F-02 · Blind SSRF via authorization_servers[]	CVE-2026-51995	7.5 High	0.1.32–0.1.38	Local PoC, reverified
F-04 · MD5-based storage namespace hardening	CVE-2026-51996	9.8 Critical	0.0.14–0.1.38	Defense-in-depth / corrected
F-08 · Internal-address validation before browser launch	CVE-2026-51997	8.8 High	0.1.16–0.1.38	Source review
F-09 · OAuth credentials stored in cleartext	—	—	0.0.11–0.1.38	Source review
F-10 · Redirect following bypasses one-time URL validation	—	—	0.1.32–0.1.38	Source review
F-11 · Explicit token-origin binding as transport hardening	CVE-2026-52001	7.5 High	0.0.18–0.1.38	Defense-in-depth / corrected

Each advisory names its CVE record in its Classification block. F-09 and F-10 carry no public record; two further identifiers, CVE-2026-51998 and CVE-2026-51999, remain RESERVED.

Research update: 9 October 2026

Researcher: Alex Gercog (playb0t). The research dossier adds three results:

• Published CLI 0.14.3. The unchanged CLI completed three local stdio scenarios with 43 HTTP events, a controlled HTTP 302 redirect included: it followed the server-selected resource_metadata destination of F-01 (CVE-2026-51994) and made the subsequent authorization-server metadata request of F-02 (CVE-2026-51995). The fixture used http-only transport, client-credentials mode and synthetic static client information; a real OAuth login and desktop UI were not tested.
• Release history. Selected first-party discovery helpers were traced and executed across 58 stable releases, 0.1.32 through 0.14.3, in 74 integrity-checked archives, recording 290 local HTTP events. The file entered upstream in commit d20f5958, published as 0.1.32 on 17 December 2025.
• Code distribution. The distribution map records selected code and namespace signatures under 12 other npm names (8 with reference-function matches, 4 namespace-only) and in 8 other Git repositories, inside bundles above the 350 KiB indexing limit of GitHub code search. The download snapshot records 19,060,907 npm downloads between 17 February and 7 October 2026.

The selected metadata path is classified as CWE-918 / Missing Defense. These runs establish the recorded request behavior under the stated fixture conditions; they do not by themselves establish disclosure of sensitive information or change the published CVE ranges, and they identify no fixed release.

Evidence and accounting · Recorded procedures · Data and checksums

Research update: 15 October 2026

Researcher: Alex Gercog (playb0t). The 0.15.1 follow-up repeats the 9 October procedure on the release published the day before.

• Upstream moved. On 14 October 2026 the maintainer published 0.14.4, 0.14.5, 0.15.0 and 0.15.1 between 18:27 and 22:36 UTC. They are the first releases since 0.14.3 of 21 September. They carry five contributor pull requests and one commit of his own, all on the OAuth callback, the coordination and the credential store. One of them fixes a callback XSS reported by another researcher. No release note, commit or pull request names any of the five records. No fixed release is stated.
• Published CLI 0.15.1. The unchanged 9 October procedure ran on the SRI-verified 0.15.1 package. It gave the same three scenario snapshots as 0.14.3: 43 HTTP events, 15 canary events, a controlled HTTP 302 followed. The client fetched the server-selected resource_metadata destination of F-01 (CVE-2026-51994) and made the authorization-server metadata request of F-02 (CVE-2026-51995). The full trace of the run also holds a POST /token carrying an Authorization header to the loopback canary, the authorization server the server's metadata named. The same event appears in 0.14.3 runs; it sits outside the 9 October snapshot. Twelve runs across the five versions are kept. Three of them were stopped by the procedure's own no-Authorization assertion.
• Code and SDK. The ten helper functions behind the five records are byte-identical between 0.14.3 and 0.15.1. The 24 helper-level checks pass. The bundle still carries @modelcontextprotocol/client 2.0.0. The issuer-binding change of client 2.2.0 and the redirect policy of client 2.3.0 are absent from it.

F-08 is confirmed in source only, F-11 in source plus the executed endpoint listener; neither by a full run. A third distinct origin in the redirect chain was not measured. The follow-up establishes that these request paths are present in 0.15.1 under the stated fixture. It does not extend any official affected range, and it identifies no fixed release.

Follow-up report, data and checksums

Research update: 25 October 2026

Researcher: Alex Gercog (playb0t). MCP Host Matrix, a separate repository, compares what MCP hosts document with what they do on a bench. It covers five native hosts (VS Code, Claude Code, Cursor, Zed, Cascade) and the mcp-remote bridge across six directions. Pinned versions, controls and limits sit beside every result.

• Disconnecting. Selected disconnect actions did not revoke in 12 of 12 base windows. No revocation request reached the provider, and the prior refresh token still worked in a separate replay with the client's own credentials. Claude Code logout and Clear authentication did revoke.
• Updating. Prior authority survived a build replacement in 8 of 8 cells. In the bridge rows, 0.1.38 to 0.15.2, the launch selection changed before access expiry. The new version asked for a new authorization. The old grant stayed alive at the provider.
• The bridge, 0.15.2. Three more directions were measured on the bridge. Credentials stayed usable after claude mcp remove deleted the configuration entry (R02). An authorization URL reached an executable boundary (R04). An HTTP 307 carried the refresh body to a second origin (R05).

The matrix assigns no severity and extends no CVE record. The records on the package stay here.

R01 to R06 evidence · Disconnection page · Connectivity page

Registries and pickup

Registry status, 7 October 2026 — a dated snapshot, kept as history

• CVE records. Five records published by MITRE as the CNA on 2026-09-24: CVE-2026-51994 (F-01), CVE-2026-51995 (F-02), CVE-2026-51996 (F-04), CVE-2026-51997 (F-08) and CVE-2026-52001 (F-11). Two further identifiers reserved for this request remain unpublished.
• CISA-ADP CVSS 3.1. CVE-2026-51996 9.8 Critical (added 2026-09-29), CVE-2026-51994 9.1 Critical, CVE-2026-51997 8.8 High (user interaction required), CVE-2026-51995 7.5 High, CVE-2026-52001 7.5 High (added 2026-10-06). The values are reported as published.
• NVD. All five records are in status Deferred; NVD displays CISA's metrics as secondary and holds none of its own.
• GitHub Advisory Database. The five records appear as unreviewed entries without a package mapping, so Dependabot does not alert on them; the only reviewed advisory mapped to the npm package mcp-remote is CVE-2025-6514 (2025-07-09).
• OSV. OSV derives version ranges from the description text and lists 0.1.38 as fixed; the commit it names as the fix is the 0.1.38 release itself, and the records include 0.1.38. The records' structured affected field reads n/a; a request to populate it with the ranges from the descriptions was sent to the CNA on 30 September 2026.
• CISA KEV. None of the five records is listed in the Known Exploited Vulnerabilities catalog as of 2026-10-04 (catalog of 1,734 entries); CISA's SSVC on all five records reads exploitation: none.

Picked up: agent-audit-kit v0.6.18 added CVE-2026-52001 to its mcp-remote rule within eight hours of the issue and credited the report. UltraRAG fixed the remote-MCP launch reported in issue #537 within 27 hours and credited the report; the fixed path starts an unpinned npx -y mcp-remote, and issue #541 put the five records to the project the same day. Supabase merged the pull request that moves its Devin preset off the bridge to the client's native HTTP path, seven hours from opening to merge; the records went to the thread after the merge.

Responsible-disclosure summary

The private advisory was submitted on 17 February 2026 and the findings revalidated on 3 May 2026 after no maintainer response or new release; the reviewed and revalidated commit is 02619aff36e79803d7c894e8c8ae7b34b2d11f8c (0.1.38). Public disclosure on 31 July 2026 followed an extended coordination period. Since disclosure, releases 0.1.39 (21 August 2026) through 0.15.1 (14 October 2026) were published from punkpeye/mcp-remote, where the repository moved; the CVE records name it geelen mcp-remote, and the geelen URLs redirect. The earlier CVE-2025-6514 fixed command injection in the browser-launch path in 0.1.16; this repository documents the adjacent trust-boundary findings.

Full timeline · Scope and version corrections · Publication corrections and upstream routing

Use and citation

Discovered and reported by Alex Gercog (playb0t). Defenders, maintainers and vulnerability databases may cite the stable advisory URLs in this repository; when citing a finding, preserve its ID, version range, evidence class and limitations. Machine-readable citation metadata: CITATION.cff.

Text and data are licensed under CC BY 4.0. The research tools, the *.py, *.js, *.cjs and *.mjs files under docs/, are licensed under MIT. Third-party code excerpts in docs/research-2026-10-09/procedures/screening/references/ keep their original licenses, listed in its notices.

Articles: Five mcp-remote CVE records, five CISA scores, no stated fix (8 October 2026, second edition) · The Server Named the URL, the Client Went (30 September 2026, first edition).