Two Inspector flaws turned one MCP connection into code on your machine. Fixes shipped.
By Lior AharonovFounder, 7IT Solutions ·
On 21 October 2026 the MCP Inspector project published nine security advisories. Two are Critical at CVSS 9.6: a malicious remote server could run local commands through the OAuth callback (versions 0.13.0 to 1.0.2) or through its MCP App (0.20.0 to 1.0.2). Version 1.0.3 fixes both, and 2.12.0 fixes the issues in the 2.x line.
Inspector is the tool you open to poke at a server you do not trust yet. Connect it to the wrong one and, per the advisories, the attacker runs commands on the laptop that holds your keys.
Update to Inspector 2.12.0, or 1.0.3 if you stay on the 1.x line, before you connect it to any server you did not write. Remove older copies pinned in scripts.
The debugger is part of your attack surface. Treat every unknown server like an email attachment.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.