Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The rmcp OAuth client accepts a server-controlled resourcemetadata= URL from the WWW-Authenticate header and fetches it without same-origin or private-network validation. An attacker-controlled MCP server can return a 401 WWW-Authenticate: Bearer resourcemetadata="..." header pointing at an internal URL, including localhost, RFC 1918 addresses, or cloud metadata endpoints. The client then performs an outbound GET to that URL from the victim application's network context. Affected version - Repository: modelcontextprotocol/rust-sdk - Crate: rmcp - Current main reviewed: c330fede90e4729c234f8e87fdbc5ea27a1dd10c - Commit date: 2026-05-19 - Affected file: crates/rmcp/src/transport/auth.rs - File blob: 3aa3e91310662c409af9dc38c9d584d6df217e9c - Severity framing: High/Medium SSRF, depending on the embedding application's network position and whether response parsing gives the attacker useful success/failure or chained fetch behavior. Source evidence extractwwwauthenticateparams()…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers (such as X-API-Key, X-Auth-Token, Api-Key) to cross-origin redirect targets. The defaulthttpclient() function builds a reqwest::Client without a redirect policy override, so the default limited(10) policy follows 307/308 redirects and forwards all per-request headers except Authorization, Cookie, and Proxy-Authorization. Custom auth headers injected via StreamableHttpClientTransportConfig.customheaders are not classified as sensitive and are therefore forwarded verbatim to any redirect target — including an attacker-controlled server. Affected versions - Repository: github.com/modelcontextprotocol/rust-sdk - Crate: rmcp - Commit tested: c330fede90e4729c234f8e87fdbc5ea27a1dd10c (HEAD, 2026-05-21) Vulnerability File: crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs Root cause 1 — no redirect policy override: No .redirect(reqwest::redirect::Policy::none()) call. The…
Recommended action: Upgrade to 2.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the body, then early-returns on the validation failure without calling closesession. The LocalSessionHandle (and the tokio mpsc channel internals it holds) is never released for the remainder of the process's lifetime — turning a ~250-byte request into a permanent ~400–550-byte server-side allocation that scales linearly with request volume and eventually exhausts memory. In the verified reproduction below, a single Python client sustains over 2 000 leak requests per second; that translates to roughly 170 million leaked entries per day, equivalent to ≈75 GB of resident memory just from the session table. Details The bug lives in crates/rmcp/src/transport/streamablehttpserver/tower.rs inside…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata (RFC 9728), allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens. Details RFC 9728 specifies two MUST requirements for resource parameter validation: - Section 7.3: the client MUST ensure that the resource identifier URL it is using as the prefix for the metadata request exactly matches the resource value in the returned metadata document. - Section 3.3: if the resource value returned is not identical to the URL the client used, the data MUST NOT be used. In the current implementation (crates/rmcp/src/transport/auth.rs), the ResourceServerMetadata struct (lines 390–394) does not include a resource field: And discoveroauthserverviaresourcemetadata() (lines 1446–1465) proceeds without any resource URL validation. Recommended fix 1. Add the resource field to the struct: 2. Add validation logic after fetching…
Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.