Vulnerability in RMCP Rust SDK Allows DNS Rebinding Attacks on MCP Servers
CVE-2026-42559

8.8HIGH

Key Information:

Vendor: Modelcontextprotocol
Status: Rust-sdk
Vendor: CVE Published:; 14 May 2026

🔔 Create Modelcontextprotocol Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-42559?

A vulnerability exists in the RMCP Rust SDK that allows for improper validation of the incoming Host header in its Streamable HTTP server transport. This flaw can be exploited through a DNS rebinding attack, enabling a malicious public website to send authenticated requests to an MCP server running on a victim's private network interface. This vulnerability has been addressed in version 1.4.0 of the SDK, reinforcing the need for proper host validation to prevent such exploits.

Affected Version(s)

rust-sdk < 1.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-42559
Created by joaovicdev