# MCP Inspector: a malicious server's OAuth redirect runs local commands

> MCP Inspector, the official tool for testing MCP servers, could be made to run an attacker's command just by connecting to one.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Model Context Protocol
- **Disclosed:** 2026-10-21
- **CVSS:** 9.6
- **Affects:** MCP Inspector, @modelcontextprotocol/inspector, @modelcontextprotocol/inspector-client, @modelcontextprotocol/inspector-server
- **Research by:** [Bhavya Gupta](https://github.com/bhavya32), [eilonc-pillar](https://github.com/eilonc-pillar), Lemohang Khaile, Thai Son Dinh (VinSOC Labs), 0xParth, hackyhunter
- **Primary source:** https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86
- **Page:** https://theinjection.dev/items/mcp-inspector-oauth-callback-stdio-rce/

MCP Inspector 1.0.2 and earlier let a malicious remote MCP server run local commands, two critical flaws among nine advisories the project published on October 21, 2026. Fixes ship in 1.0.3 and 2.12.0.

## What happened

The Model Context Protocol project published nine security advisories for MCP Inspector on October 21, 2026, two of them critical at CVSS 9.6. Bhavya Gupta reported both critical flaws, and eilonc-pillar, Lemohang Khaile, Thai Son Dinh of VinSOC Labs, 0xParth and hackyhunter reported others in the batch. Releases 1.0.3 and 2.12.0 carry the fixes.

## How it works

In the first critical flaw, a malicious server returns an OAuth challenge pointing at an authorization server the attacker controls, which appends Inspector connection parameters to the callback URL. The callback page reads a transport type, a command and arguments out of that URL and reconnects, sending the command to Inspector's local stdio proxy endpoint, which launches it. The second critical flaw is a token theft chain: a sandboxed MCP App asks the top window to open a popup, the popup shares sessionStorage because it opens without noopener, and the leaked proxy auth token then authenticates a request to that same stdio endpoint. A separate high-severity flaw puts the OAuth authorization URL inside a PowerShell double-quoted string, so PowerShell evaluates a subexpression written into it.

## Who is affected

Both critical flaws cover @modelcontextprotocol/inspector and its client and server packages, from 0.13.0 and 0.20.0 up to 1.0.2. The v2 line is hit by a different set: the PowerShell injection and a DNS-rebinding token disclosure reach 2.0.0 through 2.11.0, and the PowerShell path only on Windows and the Windows Subsystem for Linux. Version ranges are listed below.

## What to do

Upgrade MCP Inspector to 1.0.3 on the v1 line or 2.12.0 on the v2 line. The DNS-rebinding advisory says an attacker holding the API token could read stored OAuth access and refresh tokens, server configs and local client-config files, so rotate the credentials any exposed Inspector held. The 2.12.0 notes add an MCP_INSPECTOR_ALLOWED_HOSTS setting for reverse proxies that rewrite the Host header.

## Quick facts

- **Affected:** @modelcontextprotocol/inspector 0.13.0 to 1.0.2 for the critical flaws, 2.0.0 to 2.11.0 for the v2 flaws
- **Fixed in:** 1.0.3 on the v1 line and 2.12.0 on the v2 line, both released October 21, 2026
- **CVE:** None assigned
- **CVSS:** 9.6 for GHSA-4fc4-wcmh-4g86 and GHSA-6x67-4w4w-9f3w, 8.8 for GHSA-q978-78c7-phqw, 7.5 for GHSA-wmjf-2m46-2352
- **Found by:** Bhavya Gupta, eilonc-pillar, Lemohang Khaile, Thai Son Dinh of VinSOC Labs, 0xParth, hackyhunter
- **Disclosed:** October 21, 2026, nine advisories at once
- **Attack type:** Remote code execution reached through a malicious MCP server's OAuth flow

## Questions

### Which MCP Inspector versions are patched?

MCP Inspector 1.0.3 patches seven advisories on the deprecated v1 line, including both CVSS 9.6 remote code execution flaws. MCP Inspector 2.12.0 patches three on the v2 line: the PowerShell injection on Windows and WSL, the DNS-rebinding token disclosure, and an uncapped fetch proxy. Both releases went out on October 21, 2026.

### Am I affected if I only connect MCP Inspector to servers I trust?

Both critical MCP Inspector flaws need a connection to a malicious remote MCP server, so an operator who connects only to servers they run is outside the described attack path. The advisories stress that connecting to an unknown server is enough on its own: no tool call, no model involvement and no further approval are needed once the connection starts.

### Does the Windows PowerShell injection in MCP Inspector affect macOS and Linux?

No. GHSA-q978-78c7-phqw affects Windows and the Windows Subsystem for Linux only, because the open package at version 10.2.0 places the OAuth authorization URL inside a PowerShell double-quoted string without escaping it. On macOS and Linux that package passes the URL as an argument vector, so no shell evaluates it. Inspector 2.12.0 moves to open version 11.

### Were CVE ids assigned to the MCP Inspector advisories?

No CVE ids were assigned to the nine MCP Inspector advisories published on October 21, 2026, and each is tracked only by a GHSA identifier. Two of them reference CVE-2025-49596, an earlier MCP Inspector flaw whose fix the project calls incomplete: GHSA-wmjf-2m46-2352 for the Origin check and GHSA-vcc9-3xgm-p9v4 for DNS rebinding.

## Sources

1. [OAuth Callback RCE](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-4fc4-wcmh-4g86)
2. [Proxy Token RCE](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-6x67-4w4w-9f3w)
3. [PowerShell Injection](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-q978-78c7-phqw)
4. [DNS Rebinding Leak](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-vcc9-3xgm-p9v4)
5. [Missing Proxy Auth](https://github.com/modelcontextprotocol/inspector/security/advisories/GHSA-wmjf-2m46-2352)
6. [Inspector 1.0.3](https://github.com/modelcontextprotocol/inspector/releases/tag/1.0.3)
7. [Inspector 2.12.0](https://github.com/modelcontextprotocol/inspector/releases/tag/2.12.0)