---
id: CVE-2026-42559
aliases:
  - RUSTSEC-2026-0189
  - GHSA-89vp-x53w-74fx
  - GHSA-fvh2-gm75-j4j7
  - RUSTSEC-2026-0140
title: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
summary: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: rmcp
product: rmcp
ecosystem: rust
affected:
  - 'rmcp >= 0.0.0-0, < 1.4.0'
patched:
  - rmcp 1.4.0
published: '2026-04-29'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:14.804412378Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0189'
references:
  - url: 'https://crates.io/crates/rmcp'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0189.html'
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/issues/815'
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/pull/764'
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/issues/815'
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/issues/822'
  - url: >-
      https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
  - url: 'https://crates.io/crates/dynoxide-rs'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0140.html'
  - url: >-
      https://github.com/nubo-db/dynoxide/commit/10292083fd16fe7116e9089ffa189f4f4f071e0f
  - url: 'https://github.com/nubo-db/dynoxide/releases/tag/v0.9.13'
tags:
  - osv
  - rust
  - exploit-available
epss: 0.00242
epssPercentile: 0.14231
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/joaovicdev/EXPLOIT-CVE-2026-42559'
  checkedAt: '2026-10-13T11:46:04.385Z'
exploitAvailable: true
ingestedAt: '2026-10-13T11:45:30.192Z'
---

## Overview

Prior to version 1.4.0, the `rmcp` crate's Streamable HTTP server transport did
not validate the incoming `Host` header.

This allowed a malicious public website, via a DNS rebinding attack, to send
requests to an MCP server running on the victim's loopback or private-network
interface.

An attacker who convinced a victim to visit a malicious page could enumerate and
invoke tools exposed by a locally running rmcp-based MCP server, read resources
and prompts, and trigger side effects limited by the tools exposed by that
server.

Non-HTTP transports such as stdio and child-process transports are not affected.

## Patches

The issue was fixed in `rmcp` 1.4.0 by adding default loopback-only host
allowlist validation for the Streamable HTTP server transport. Incoming HTTP
requests now validate the `Host` header and return HTTP 403 when the host is not
allowed.

Users should upgrade to `rmcp >= 1.4.0`.

## Workarounds

If upgrading is not possible, place the MCP server behind a reverse proxy
configured to reject requests whose `Host` header is not one of the expected
hostnames. Do not bind the MCP server to `0.0.0.0` without such validation.

## Affected packages

- `rmcp >= 0.0.0-0, < 1.4.0`

## Remediation

Upgrade to a patched release:

- `rmcp 1.4.0`