RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | rust-sdk | before 1.4.0 | 1.4.0 | Patch available | CNA |
| — | rmcp (crates.io) | before 1.4.0 | 1.4.0 | Patch available | GHSA-89vp-x53w-74fx |
- rust-sdk VendorMLflow Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
- rmcp (crates.io) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-89vp-x53w-74fx
Remediation
- Fix · CNA rust-sdk (modelcontextprotocol) Fixed in 1.4.0
- Fix · GHSA-89vp-x53w-74fx rmcp (crates.io) Fixed in 1.4.0 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42559
- 2026-10-03 Alias added: GHSA-89vp-x53w-74fx
References
Other 9
- https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx
- https://github.com/modelcontextprotocol/rust-sdk/issues/815
- https://github.com/modelcontextprotocol/rust-sdk/issues/822
- https://github.com/modelcontextprotocol/rust-sdk/pull/764
- https://github.com/modelcontextprotocol/rust-sdk/commit/8e22aa2de28df5a285eed87c11cd89bf15fa90d3
- https://github.com/nubo-db/dynoxide/security/advisories/GHSA-fvh2-gm75-j4j7
- https://github.com/modelcontextprotocol/rust-sdk
- https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
- https://rustsec.org/advisories/RUSTSEC-2026-0140.html
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-42559 · CVE Program
- CVE-2026-42559 · NVD
- FIRST EPSS
- GHSA-89vp-x53w-74fx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42559 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences