{"id":"CVE-2026-42559","aliases":["RUSTSEC-2026-0189","GHSA-89vp-x53w-74fx","GHSA-fvh2-gm75-j4j7","RUSTSEC-2026-0140"],"title":"DNS rebinding vulnerability in rmcp Streamable HTTP server transport","summary":"DNS rebinding vulnerability in rmcp Streamable HTTP server transport","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"rmcp","product":"rmcp","ecosystem":"rust","affected":["rmcp >= 0.0.0-0, < 1.4.0"],"patched":["rmcp 1.4.0"],"published":"2026-04-29","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:14.804412378Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0189","references":[{"url":"https://crates.io/crates/rmcp"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0189.html"},{"url":"https://github.com/modelcontextprotocol/rust-sdk/issues/815"},{"url":"https://github.com/modelcontextprotocol/rust-sdk/pull/764"},{"url":"https://github.com/modelcontextprotocol/rust-sdk/issues/815"},{"url":"https://github.com/modelcontextprotocol/rust-sdk/issues/822"},{"url":"https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning"},{"url":"https://crates.io/crates/dynoxide-rs"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0140.html"},{"url":"https://github.com/nubo-db/dynoxide/commit/10292083fd16fe7116e9089ffa189f4f4f071e0f"},{"url":"https://github.com/nubo-db/dynoxide/releases/tag/v0.9.13"}],"tags":["osv","rust","exploit-available"],"epss":0.00242,"epssPercentile":0.14231,"exploits":{"github":1,"githubRepos":["https://github.com/joaovicdev/EXPLOIT-CVE-2026-42559"],"checkedAt":"2026-10-13T11:46:04.385Z"},"exploitAvailable":true,"ingestedAt":"2026-10-13T11:45:30.192Z","slug":"CVE-2026-42559","body":"## Overview\n\nPrior to version 1.4.0, the `rmcp` crate's Streamable HTTP server transport did\nnot validate the incoming `Host` header.\n\nThis allowed a malicious public website, via a DNS rebinding attack, to send\nrequests to an MCP server running on the victim's loopback or private-network\ninterface.\n\nAn attacker who convinced a victim to visit a malicious page could enumerate and\ninvoke tools exposed by a locally running rmcp-based MCP server, read resources\nand prompts, and trigger side effects limited by the tools exposed by that\nserver.\n\nNon-HTTP transports such as stdio and child-process transports are not affected.\n\n## Patches\n\nThe issue was fixed in `rmcp` 1.4.0 by adding default loopback-only host\nallowlist validation for the Streamable HTTP server transport. Incoming HTTP\nrequests now validate the `Host` header and return HTTP 403 when the host is not\nallowed.\n\nUsers should upgrade to `rmcp >= 1.4.0`.\n\n## Workarounds\n\nIf upgrading is not possible, place the MCP server behind a reverse proxy\nconfigured to reject requests whose `Host` header is not one of the expected\nhostnames. Do not bind the MCP server to `0.0.0.0` without such validation.\n\n## Affected packages\n\n- `rmcp >= 0.0.0-0, < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rmcp 1.4.0`","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}