Executive brief
The rmcp library, used for building Model Context Protocol (MCP) servers that connect AI models to local tools and data, contains a vulnerability in its HTTP transport component. A malicious website can exploit this to bypass security boundaries and send unauthorized commands to an MCP server running on a user's private network or local machine. This could allow an attacker to read sensitive files, execute system commands, or access developer tools with the same permissions as the local user.
Technical details
The rmcp crate's Streamable HTTP server transport (prior to version 1.4.0) does not validate the incoming HTTP 'Host' header. This oversight allows for DNS rebinding attacks where a malicious public website can resolve to a victim's loopback (127.0.0.1) or private IP address, bypassing the Same-Origin Policy. An attacker can then send authenticated requests to the MCP server to enumerate tools, read resources, or trigger side effects like shell execution. The vulnerability is fixed in version 1.4.0 by implementing a default allowlist for the Host header (localhost, 127.0.0.1, ::1) and providing a validation middleware.
Affected products
- modelcontextprotocol rmcp < 1.4.0
Timeline
- 2026-04-09: patched: Version 1.4.0 released
- 2026-04-29: disclosed: Advisory published on GitHub
- 2026-05-06: advisory: GitHub Advisory reviewed and published to database
- 2026-05-14: kev added: NVD publication date