Vulnerability in RMCP Rust SDK Allows DNS Rebinding Attacks on MCP Servers

CVE-2026-42559

What is CVE-2026-42559?

A vulnerability exists in the RMCP Rust SDK that allows for improper validation of the incoming Host header in its Streamable HTTP server transport. This flaw can be exploited through a DNS rebinding attack, enabling a malicious public website to send authenticated requests to an MCP server running on a victim's private network interface. This vulnerability has been addressed in version 1.4.0 of the SDK, reinforcing the need for proper host validation to prevent such exploits.

References