The vulnerability involves server‑side request forgery, where an attacker can cause the mcp‑remote service to request a URL embedded in the WWW‑Authenticate header of a remote MCP server. This flaw enables the malicious party to force the service to communicate with arbitrary destinations, potentially exposing sensitive internal network resources or facilitating further attacks. The weakness directly originates from improper validation of the resource_metadata URL extracted from the authentication header, which is a classic example of the REST API design flaw under CWE‑918.

Versions of the open‑source mcp‑remote tool from 0.1.32 through 0.1.38 are vulnerable. Any deployment configured to use these revisions and that can reach a remote MCP server during authentication exchange is at risk. Earlier releases and versions newer than 0.1.38 are not affected unless they contain the same unprotected extraction logic.

The CVSS score of 9.1 classifies this SSRF as critical, and the EPSS score of <1% suggests it is an unlikely but possible exploit. The vulnerability can be leveraged remotely by directing the mcp‑remote service to request a URL extracted from a remote MCP server’s WWW‑Authenticate header, allowing arbitrary outbound connections to internal networks or external hosts. This could expose sensitive data or provide a foothold for further attacks, especially since the KEV listing is absent but the severity remains high.