MCP Inspector patches cloud metadata SSRF gap and DoS flaw

The Model Context Protocol project released Inspector v2.15.0 and v1.0.5 on November 11, 2026, patching an incomplete SSRF guard and an unbounded memory growth bug in its official MCP server and client debugging tool, according to the GitHub advisory tracking the SSRF guard fix.

What changed in the patch

• GHSA-fvg8-f358-w2c8: the SSRF guard function isBlockedAddress blocked only 169.254.0.0/16, fe80::/10 and fd00:ec2::254, missing Alibaba Cloud ECS metadata (100.100.100.200) and retired Oracle Cloud Classic metadata (192.0.0.192).
• The gap affects Inspector v2 releases 2.13.0 through 2.14.0 and the entire v1 line, fixed in v2.15.0 and v1.0.5.
• It is exploitable only through a hostile OAuth server combined with non-hardened IMDS, and is rated Medium or Low severity.
• GHSA-9w48-x22j-rrm7: the network-log fetch tracker read POST text/event-stream responses in full with no size cap, letting memory grow unbounded and crashing the backend for all sessions; v2.15.0 fixes this with a 1 MiB capped reader, per the GitHub issue tracking the unbounded buffer fix.
• v1.0.5 also bumped the npm dependency open to version 11 or higher for GHSA-q978-78c7-phqw, a PowerShell subexpression injection RCE reachable via a malicious OAuth redirect URL on Windows or WSL, tracked in the release tracking issue for v1.0.5.

Why it matters for MCP builders

MCP Inspector is the official reference tool developers use to test and debug MCP servers and clients, so a flaw letting a malicious MCP or OAuth server reach cloud instance metadata endpoints or crash a debugging session undermined the tool meant to vet MCP server safety. Teams running Inspector against untrusted servers should upgrade before trusting it to validate server behavior.

No known exploitation

The advisory reports no in-the-wild exploitation of the SSRF gap, the buffer DoS, or the Windows RCE path addressed by the dependency bump; all three were proactive, coordinated fixes, and the RCE path was not actually reachable in Inspector v1 itself.

Sources

• MCP Inspector SSRF guard metadata gap (GitHub - Model Context Protocol, November 11, 2026, official)
• MCP Inspector unbounded buffer DoS (GitHub - Model Context Protocol, November 11, 2026, official)
• Inspector v1.0.5 release tracking issue (GitHub - Model Context Protocol, November 11, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.