The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

CVE-2026-81091 is a Server-Side Request Forgery (SSRF) vulnerability in the proxy middleware of mcp-use's inspector component. The vulnerable function mountMcpProxy in mcp-proxy.ts reads the target URL from the X-Target-URL header or __mcp_target parameter and forwards requests without validating the destination host. This allowed callers to direct the server to issue requests to loopback, link-local, and private network addresses, as well as hostnames that resolve to them. Additionally, redirect responses from the destination were not re-validated, enabling redirect-based bypass. An attacker could exploit this to access internal services and read responses from addresses only reachable from the host machine. The fix introduces an isSafeProxyTarget function that checks resolved addresses against private, loopback, and link-local ranges and limits redirect following.