MCP Inspector 2.15.0, released on November 12, 2026, includes four security fixes. The tool is used to inspect MCP integrations, and the changes illustrate that agent safety also depends on the environment surrounding models. The official release links each fix to a separate GHSA advisory. At this check, the records have no known CVE identifiers and their current ratings are Low or Moderate, so describing them as four critical CVEs would be inaccurate.
Different problems and affected ranges
GHSA-fvg8-f358-w2c8 concerns network protections against requests to cloud metadata addresses outside one commonly blocked range. The affected v2 range is 2.0.0–2.14.0, patched in 2.15.0. The advisory lists a separate correction for the older v1 branch; instructions for different major versions should not be mixed. Its current rating is Low 3.1.
GHSA-9w48-x22j-rrm7 concerns an unbounded POST event-stream response. Recording it can exhaust the shared backend's memory and interrupt multiple sessions. Versions 2.0.0–2.14.0 are affected, with the fix in 2.15.0. The current rating is Moderate 6.5. This is an availability issue, not automatic evidence of data theft.
GHSA-pp85-586h-2m95 specifically affects 2.14.0. When importing server.json, the command preview does not adequately expose environment-variable values that can change execution behavior. Version 2.15.0 expands the preview and warnings for these settings. The advisory is rated Low; the user actions required are an important part of its context.
GHSA-5572-x678-xmv8 concerns the identity of the local mcpdo daemon and the risk of impersonating it. Versions 2.10.0–2.14.0 are affected, patched in 2.15.0, with a current Moderate 5.0 rating. The release describes checking the daemon before transmitting data. A predictable local connection name is insufficient evidence of the identity at the other end.
What this means for AI integrations
Our editorial analysis is that these cases belong to different trust boundaries. A network destination determines where a request may go. A data stream determines how many resources a remote response may consume. Configuration determines what actually starts. Local-service identity determines who receives data. A successful check in one area does not replace the others.
A hypothetical team might run Inspector only on a workstation and still face different risks depending on the connected servers and imported configurations. Local describes an execution location; it does not establish the origin of every input. An integration review therefore needs concrete inputs and dependencies, rather than relying on a protocol's name.
Checking an update
A defensive operational approach begins by identifying the version actually running, including containers or long-lived processes. After an update, check whether normal integrations still work and whether the old process has been replaced. A dependency declaration changing on disk is not evidence that the active process contains the fix. These are editorial recommendations, without exploitation examples or tests against other people's systems.
SIExpo has not exercised the vulnerabilities and does not certify a particular installation's security. What is verified is publication of the corrections, their version ranges and their described defensive purpose. Updating Inspector does not mean that every connected MCP server or agent has undergone an independent audit.
Sources: MCP Inspector — release 2.15.0, Inspector — fetch guard advisory, Inspector — unbounded event-stream advisory, Inspector — server.json launch preview advisory, Inspector — connection daemon identity advisory.
The cover is a conceptual AI illustration, not a documentary photograph.
Editorial verification: 2026-11-13T07:35:06.745176+00:00.
