CVE-2026-51995 Details

A blind server-side request forgery (SSRF) vulnerability has been identified in Geelen MCP-Remote versions 0.1.32 through 0.1.38. This issue arises because the application fetches OAuth authorization server metadata from a URL specified by the server, without validating the origin of that URL. As a result, an attacker can manipulate the metadata to initiate requests to internal services or other network resources, potentially leading to unauthorized information disclosure or exploitation of vulnerabilities on those services.

It is recommended to validate the origins of authorization server URLs before fetching metadata, apply controls to prevent internal address access and unauthorized DNS resolution, and maintain a trust record of resource-to-authorization server decisions throughout the OAuth process.