Summary
A high-severity information disclosure vulnerability in geelen mcp-remote may allow a remote attacker to obtain sensitive information through the SSE transport's eventSourceInit fetch wrapper.
The issue becomes risky when the affected transport is remotely reachable and the wrapper exposes response data, headers, or other runtime information beyond what the requesting client should receive.
A high-severity information disclosure vulnerability in geelen mcp-remote may allow a remote attacker to obtain sensitive information through the SSE transport's eventSourceInit fetch wrapper.
The issue becomes risky when the affected transport is remotely reachable and the wrapper exposes response data, headers, or other runtime information beyond what the requesting client should receive.
Affected context
The vulnerability affects mcp-remote versions 0.1.18 through 0.1.38 when the SSE transport uses the eventSourceInit fetch wrapper in src/lib/utils.ts.
Exposure depends on the SSE service being reachable by an attacker and on sensitive data being available through the wrapper's request or response handling. Deployment-specific authentication, network controls, and transport configuration may limit the affected surface.
The vulnerability affects mcp-remote versions 0.1.18 through 0.1.38 when the SSE transport uses the eventSourceInit fetch wrapper in src/lib/utils.ts.
Exposure depends on the SSE service being reachable by an attacker and on sensitive data being available through the wrapper's request or response handling. Deployment-specific authentication, network controls, and transport configuration may limit the affected surface.
Exploit preconditions
- Attack surface: The remotely reachable SSE transport endpoint
- Required access: Network access to the affected service; authentication requirements depend on deployment configuration
- Trigger point: Processing an SSE request through the eventSourceInit fetch wrapper
- Why exploitation is possible: The transport or wrapper may disclose information that is not appropriately restricted to the requesting remote party
- Attack surface: The remotely reachable SSE transport endpoint
- Required access: Network access to the affected service; authentication requirements depend on deployment configuration
- Trigger point: Processing an SSE request through the eventSourceInit fetch wrapper
- Why exploitation is possible: The transport or wrapper may disclose information that is not appropriately restricted to the requesting remote party
Why this happens
The underlying issue is an information exposure flaw in the handling of requests or responses by the SSE transport's fetch wrapper.
Information that should remain internal or restricted may be propagated to a remote requester without sufficient filtering, authorization, or response-boundary enforcement. This behavior maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
The underlying issue is an information exposure flaw in the handling of requests or responses by the SSE transport's fetch wrapper.
Information that should remain internal or restricted may be propagated to a remote requester without sufficient filtering, authorization, or response-boundary enforcement. This behavior maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Potential impact
- An attacker may obtain sensitive response content or transport metadata
- Confidential configuration or runtime information could be disclosed
- Exposed data could support follow-on attacks against connected services
- Credentials, tokens, or other secrets could be revealed if they enter the affected data path
- An attacker may obtain sensitive response content or transport metadata
- Confidential configuration or runtime information could be disclosed
- Exposed data could support follow-on attacks against connected services
- Credentials, tokens, or other secrets could be revealed if they enter the affected data path
General mitigation guidance
Mitigation generally focuses on reducing the information that crosses the SSE transport boundary and enforcing explicit authorization before returning data.
Common defensive patterns include:
- Restricting response bodies, headers, and errors to data required by the client
- Applying explicit allowlists for fields and metadata exposed through transport wrappers
- Avoiding propagation of credentials, internal URLs, stack traces, and environment details
- Enforcing authentication and authorization at the SSE endpoint and downstream request layers
- Using least-privilege service identities and minimizing accessible backend data
- Treating remote transport input and request context as untrusted
Mitigation generally focuses on reducing the information that crosses the SSE transport boundary and enforcing explicit authorization before returning data.
Common defensive patterns include:
- Restricting response bodies, headers, and errors to data required by the client
- Applying explicit allowlists for fields and metadata exposed through transport wrappers
- Avoiding propagation of credentials, internal URLs, stack traces, and environment details
- Enforcing authentication and authorization at the SSE endpoint and downstream request layers
- Using least-privilege service identities and minimizing accessible backend data
- Treating remote transport input and request context as untrusted
How teams detect issues like this
Organizations can assess this class of issue through:
- Static analysis for wrappers that forward complete responses, headers, or error details
- Code review checks for missing authorization and response-field filtering at transport boundaries
- Tests that verify unauthorized clients cannot retrieve backend metadata or sensitive content
- Runtime monitoring for unusual SSE access patterns, repeated enumeration, and unexpected response sizes
- Policy enforcement requiring explicit data allowlists for remote protocol responses
Automated code review and secret-scanning tools may help identify exposed credentials or overly broad response handling.
Organizations can assess this class of issue through:
- Static analysis for wrappers that forward complete responses, headers, or error details
- Code review checks for missing authorization and response-field filtering at transport boundaries
- Tests that verify unauthorized clients cannot retrieve backend metadata or sensitive content
- Runtime monitoring for unusual SSE access patterns, repeated enumeration, and unexpected response sizes
- Policy enforcement requiring explicit data allowlists for remote protocol responses
Automated code review and secret-scanning tools may help identify exposed credentials or overly broad response handling.
