Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-52001: geelen mcp-remote 0.1.18‑0.1.38 may leak data to attackers
CVE-2026-52001 · published 1 month ago
Summary
The mcp-remote tool versions 0.1.18 through 0.1.38 contain a flaw in its SSE transport code that can be triggered from outside the network. An attacker who can reach the application could retrieve information that should be private. Update to a newer version or apply the vendor's patch to stop the data leak.
Original advisory text
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts
An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts
References
- https://github.com/geelen/mcp-remote/security/advisories Vendor Advisory
- https://github.com/geelen/mcp-remote Product
- https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-11... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52001... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-52001 Vendor Advisory
- https://github.com/playb0t/mcp-remote-oauth-security#readme Product
Severity
7.5
High
Type
CWE-200Information Exposure
Timeline
Published24 Sep 2026
Updated4 Nov 2026
First seen24 Sep 2026
Track software like this
Free during beta