CVE-2026-42559: Model Context Protocol RMCP DNS rebinding in Streamable HTTP server

CVE-2026-42559 · Severity: high · CVSS 8.8 · Published 2026-05-14

The rmcp library, used for building Model Context Protocol (MCP) servers that connect AI models to local tools and data, contains a vulnerability in its HTTP transport component. A malicious website can exploit this to bypass security boundaries and send unauthorized commands to an MCP server running on a user's private network or local machine. This could allow an attacker to read sensitive files, execute system commands, or access developer tools with the same permissions as the local user.

Technologies: Anthropic Model Context Protocol, rmcp (crates.io), Model Context Protocol Python SDK. Vendors: Anthropic, crates.io, Model Context Protocol, npm.

Quick answers

Is CVE-2026-42559 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42559 being exploited in the wild.
How severe is CVE-2026-42559?
High severity, with a CVSS score of 8.8, published 14 May 2026.
Which products and versions are affected?
Anthropic Model Context Protocol < 1.4.0; dynoxide-rs (crates.io) SEMVER:introduced=0.9.3,fixed=0.9.13; rmcp (crates.io) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0, SEMVER:introduced=0.0.0-0,fixed=1.4.0; Model Context Protocol Python SDK < 1.4.0; and 1 more.
Is there a fix for CVE-2026-42559?
Yes. dynoxide-rs (crates.io): upgrade to 0.9.13 or later; rmcp (crates.io): upgrade to 1.4.0 or later; dynoxide (npm): upgrade to 0.9.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42559 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42559?
Check whether you run Anthropic Model Context Protocol, dynoxide-rs (crates.io), rmcp (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dynoxide-rs (crates.io): upgrade to 0.9.13 or later
    cargo update -p dynoxide-rs
  • rmcp (crates.io): upgrade to 1.4.0 or later
    cargo update -p rmcp
  • dynoxide (npm): upgrade to 0.9.13 or later
    npm install dynoxide@0.9.13

Technical details

The rmcp crate's Streamable HTTP server transport (prior to version 1.4.0) does not validate the incoming HTTP 'Host' header. This oversight allows for DNS rebinding attacks where a malicious public website can resolve to a victim's loopback (127.0.0.1) or private IP address, bypassing the Same-Origin Policy. An attacker can then send authenticated requests to the MCP server to enumerate tools, read resources, or trigger side effects like shell execution. The vulnerability is fixed in version 1.4.0 by implementing a default allowlist for the Host header (localhost, 127.0.0.1, ::1) and providing a validation middleware.

Affected products

  • modelcontextprotocol rmcp < 1.4.0

Identifiers

  • CVE-2026-42559
  • GHSA-89vp-x53w-74fx
  • GHSA-fvh2-gm75-j4j7
  • RUSTSEC-2026-0140
  • RUSTSEC-2026-0189

Timeline

  • 2026-04-09: patched: Version 1.4.0 released
  • 2026-04-29: disclosed: Advisory published on GitHub
  • 2026-05-06: advisory: GitHub Advisory reviewed and published to database
  • 2026-05-14: kev added: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.