Description
An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components
Published: 2026-09-24
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Update
AI Analysis

Impact

An issue exists in versions 0.1.32 through 0.1.38 of the geelen/mcp-remote application that allows a remote attacker to retrieve sensitive information from specific source files, including the authorization server metadata and utility components. The flaw can expose internal configuration details or credentials that are otherwise intended to remain confidential, leading to potential compromise of the application’s security posture.

Affected Systems

The vulnerability affects the geelen/mcp-remote software, specifically the 0.1.32 to 0.1.38 releases. Systems running any of these versions are exposed until the bug is addressed in a newer release.

Risk and Exploitability

The CVSS score is 7.5, indicating a high severity condition. While EPSS data is unavailable and the flaw is not listed in CISA KEV, the description indicates a remote attack vector. An attacker can exploit the exposed source components from outside the system, potentially gaining confidential data without needing privileged access.

Generated by OpenCVE AI on September 26, 2026 at 03:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade geelen/mcp-remote to a version newer than 0.1.38 as soon as a security fix is released.
  • Restrict network access to the mcp-remote service by firewalling or isolating it within a trusted subnet, limiting exposure to untrusted hosts.
  • Review and harden the authorization-server-metadata and utils components by removing or encrypting any that must remain confidential, ensuring that sensitive information is not inadvertently exposed.

Generated by OpenCVE AI on September 26, 2026 at 03:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Geelen
Geelen mcp-remote
Vendors & Products Geelen
Geelen mcp-remote

Sat, 26 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Title Remote Information Disclosure in geelen/mcp-remote via Authorization Server Metadata

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Thu, 24 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components
References

Subscriptions

Geelen Mcp-remote
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-24T14:58:22.250Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51995

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-24T15:17:23.087

Modified: 2026-09-24T21:08:55.030

Link: CVE-2026-51995

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T11:44:54Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor