CVE-2026-51994
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 24, 2026
Vendor
unknown
Description
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header