{"id":"EUVD-2026-30292","enisaUuid":"a01e3689-5a2d-31fe-829a-d61dcffa0835","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate\u0027s Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim\u0027s loopback or private-network interface. This vulnerability is fixed in 1.4.0.","datePublished":"May 14, 2026, 2:24:56 PM","dateUpdated":"May 14, 2026, 4:00:33 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/815\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/822\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/764\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/8e22aa2de28df5a285eed87c11cd89bf15fa90d3\n","aliases":"CVE-2026-42559\nGHSA-89vp-x53w-74fx\n","assigner":"GitHub_M","epss":0.27,"enisaIdProduct":[{"id":"c7fda75f-c61c-3927-956a-b5b2db08aceb","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.4.0"}],"enisaIdVendor":[{"id":"f09a88d0-1069-367d-a283-d8524479c980","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"b49e77c2-bbdc-3d84-8a8b-b7fd441e4507","vulnerability":{"id":"GHSA-89vp-x53w-74fx","description":"rmcp Streamable HTTP server transport has a DNS rebinding vulnerability","datePublished":"May 6, 2026, 9:55:56 PM","dateUpdated":"May 19, 2026, 8:17:47 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx\nhttps://github.com/nubo-db/dynoxide/security/advisories/GHSA-fvh2-gm75-j4j7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42559\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/815\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/822\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/764\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/8e22aa2de28df5a285eed87c11cd89bf15fa90d3\nhttps://github.com/modelcontextprotocol/rust-sdk\nhttps://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning\nhttps://rustsec.org/advisories/RUSTSEC-2026-0140.html\n","enisa_id":"EUVD-2026-30292\n","aliases":"CVE-2026-42559\nGHSA-89vp-x53w-74fx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b561312c-47f8-3ff4-8198-4a0be2f829b5","vulnerability":{"id":"CVE-2026-42559","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate\u0027s Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim\u0027s loopback or private-network interface. This vulnerability is fixed in 1.4.0.","datePublished":"May 14, 2026, 2:24:56 PM","dateUpdated":"May 14, 2026, 4:00:33 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/815\nhttps://github.com/modelcontextprotocol/rust-sdk/issues/822\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/764\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/8e22aa2de28df5a285eed87c11cd89bf15fa90d3\n","enisa_id":"EUVD-2026-30292\n","assigner":"GitHub_M","epss":0.27,"dataProcessed":"Oct 27, 2026, 7:17:12 AM","vulnerabilityProduct":[{"id":"81264d80-dcb7-3efc-8576-84679a5a1f84","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.4.0"}],"vulnerabilityVendor":[{"id":"702e4951-48fa-39da-aba5-b672150484f8","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[]}