CVE-2026-42559 HIGH

CVE-2026-42559: RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

Vendor Modelcontextprotocol

Product rust-sdk

Weakness CWE-346 · Origin validation

Published May 14, 2026

Last update May 14, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

Key dates

02Disclosure timeline

May 14, 2026 CVE published

May 14, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-42559 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/346.html

Related vulnerabilities

04Related CVE

CVE-2025-30360 webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser CVE-2026-10846 Insufficient verification that responses belong to a query CVE-2026-44755 Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation CVE-2026-58169 Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution