The proxy middleware in mcp-use's inspector forwards any destination specified by the caller via the X-Target-URL header or the "__mcp_target" parameter. Because it does not inspect or validate the host, loopback, link‑local, and private address ranges are all accepted. The proxy also does not re‑apply the validation when following redirects, allowing the target to redirect to an internal address. As a result, an attacker can instruct the server to reach resources that are only accessible from the host, and the attacker can read the responses, exposing internal data or services.

The vulnerability affects the mcp-use product, specifically the inspector proxy component implemented in the TypeScript library. No specific version range is listed in the CVE data; therefore any installation of mcp-use that includes the unvalidated proxy code is potentially affected.

The vulnerability scores a CVSS of 8.7, which places it in the high‑severity range. The EPSS score is not available, but the lack of a KEV listing suggests it has not yet been widely exploited publicly. The attack vector is inferred to be a remote HTTP request to the proxy endpoint, using the caller‑supplied X-Target-URL header or query parameter. Successful exploitation would allow read access to internal, potentially sensitive, resources, with the impact of confidentiality breach and possible further lateral movement. Administrators should consider the high risk and apply remediation promptly.