Skip to content
Fencer Vulns
high 8.8

CVE-2026-42559 json

RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

published 2026-04-29 6 mo ago modified 2026-10-26 13 d ago also GHSA-89vp-x53w-74fx , GHSA-fvh2-gm75-j4j7 , RUSTSEC-2026-0140 , RUSTSEC-2026-0189 , EUVD-2026-30292

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

Patch / fix

  • crates.io dynoxide-rs 0.9.13
  • npm dynoxide 0.9.13
  • crates.io rmcp 1.4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42559 updated cvss 8.8

rmcp: rmcp: Unauthorized access to MCP server via DNS rebinding vulnerability

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
crates.io dynoxide-rs
>=0.9.3, <0.9.13
0.9.13
npm dynoxide
>=0.9.3, <0.9.13
0.9.13
crates.io rmcp
<1.4.0
>=0.0.0-0, <1.4.0
1.4.0

Affected products

  • modelcontextprotocol rust-sdk

Classification

Weakness
  • CWE-346 Origin Validation Error
  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.