MCP Inspector OAuth Bugs Allowed Local Code Execution

What changed

GitHub published advisory GHSA 4fc4 wcmh 4g86 on 21 October 2026 for the Model Context Protocol Inspector. A malicious remote MCP server could abuse the OAuth callback. The server could switch Inspector from HTTP transport to stdio and run arbitrary local commands. Patched versions are 1.0.3 for the 0.13 through 1.0.2 line.

A related advisory GHSA q978 78c7 phqw covers PowerShell subexpression injection on Windows and WSL through OAuth URLs. That flaw is fixed in Inspector 2.12.0.

CVSS for the callback issue is listed at 9.6 critical on the advisory page. The Windows opener issue also lists critical impact for local code execution during connect.

Why it matters

Teams use MCP Inspector to probe unknown servers during agent pilots. These bugs turn a connect click into remote code execution on some platforms. No tool approval step is required in the described chain.

Security leads should treat MCP clients like browser installs. Unknown servers are untrusted code paths. Patch levels must be tracked like any other developer tool.

Who is affected

Agent builders on Windows and WSL face the OAuth URL injection issue. macOS and Linux desktop users are listed as not affected for that specific opener bug. Anyone on vulnerable Inspector builds connecting to untrusted MCP URLs shares the callback risk.

Red teams should add MCP client connect flows to phishing drills. Developers often treat OAuth as safe because it looks like normal SaaS login.

What to do next

Upgrade @modelcontextprotocol/inspector and @modelcontextprotocol/inspector-client to at least 1.0.3. If you run the 2.x line on Windows, move to 2.12.0 or newer. Block developer laptops from connecting Inspector to production secrets during tests.

Add MCP client versions to your software bill of materials. Scan images for pinned packages below the patched releases.

Separate inspector laptops from tokens that reach production clusters. Many agent pilots fail open because engineers reuse daily drivers.

Print the patched version numbers on your internal security bulletin. Developers patch faster when the fix is one line in Slack.

What to watch

Watch MCP spec updates that forbid config parameters in OAuth callbacks. Watch vendor SBOMs for AWS API MCP and other servers patched in the same October 2026 window. Watch enterprise policy templates for banning stdio transport switches from remote OAuth flows.

Photo: Tima Miroshnichenko / Pexels

Photo: Pixabay / Pexels

Add MCP Inspector to your allowed software list with version floors. Ad hoc installs from npm without pins recreate the same gap each quarter.

Run a five minute demo for security champions showing connect to a test server. Seeing the OAuth window helps teams respect the patch urgency.

Record which laptops used Inspector against prod adjacent keys during the vulnerable window. Rotation may be prudent even after patch if unknown servers were tested.

Block stdio transport switches from remote OAuth callbacks in internal MCP policy docs. Developers need a clear rule, not only a CVE number.

Include MCP clients in your next phishing tabletop. Attackers may pose as helpful MCP servers during agent hack weeks.

Treat Inspector like a browser with extra power. Patch it on the same cycle as Chrome or Edge on developer laptops.

Disable auto update overrides on MCP tools in dev containers. Frozen images miss these fixes for months otherwise.

Log every external MCP URL tested in Inspector during October 2026. Security reviews need that list for scope checks.

Sources

• Primary — GitHub Advisory Database, GHSA 4fc4 wcmh 4g86 MCP Inspector OAuth RCE (21 October 2026). Attack chain, affected versions, and patch levels.
• Secondary — GitHub Advisory Database, GHSA q978 78c7 phqw OAuth URL injection on Windows (21 October 2026). Platform scope and fixed version 2.12.0.