https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T12:01:40.819100+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42559 CVE-2026-42559 — RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport 2026-10-07T12:01:40.834489+00:00

Affected: modelcontextprotocol rust-sdk

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.