# CVE-2026-42559: Model Context Protocol RMCP DNS rebinding in Streamable HTTP server

Source: https://junglewise.ai/threats/cve-2026-42559-model-context-protocol-rmcp-dns-rebinding-in-streamable-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-42559 · Severity: high · CVSS 8.8 · Published 2026-05-14

The rmcp library, used for building Model Context Protocol (MCP) servers that connect AI models to local tools and data, contains a vulnerability in its HTTP transport component. A malicious website can exploit this to bypass security boundaries and send unauthorized commands to an MCP server running on a user's private network or local machine. This could allow an attacker to read sensitive files, execute system commands, or access developer tools with the same permissions as the local user.

Technologies: [Anthropic Model Context Protocol](https://junglewise.ai/threats/technologies/model-context-protocol), [rmcp (crates.io)](https://junglewise.ai/threats/technologies/rmcp), [Model Context Protocol Python SDK](https://junglewise.ai/threats/technologies/mcp-python-sdk). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Model Context Protocol](https://junglewise.ai/threats/vendors/model-context-protocol), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-42559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42559 being exploited in the wild.

**How severe is CVE-2026-42559?** High severity, with a CVSS score of 8.8, published 14 May 2026.

**Which products and versions are affected?** Anthropic Model Context Protocol < 1.4.0; dynoxide-rs (crates.io) SEMVER:introduced=0.9.3,fixed=0.9.13; rmcp (crates.io) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0, SEMVER:introduced=0.0.0-0,fixed=1.4.0; Model Context Protocol Python SDK < 1.4.0; and 1 more.

**Is there a fix for CVE-2026-42559?** Yes. dynoxide-rs (crates.io): upgrade to 0.9.13 or later; rmcp (crates.io): upgrade to 1.4.0 or later; dynoxide (npm): upgrade to 0.9.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42559 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42559?** Check whether you run Anthropic Model Context Protocol, dynoxide-rs (crates.io), rmcp (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dynoxide-rs (crates.io): upgrade to 0.9.13 or later

  ```sh
  cargo update -p dynoxide-rs
  ```

- rmcp (crates.io): upgrade to 1.4.0 or later

  ```sh
  cargo update -p rmcp
  ```

- dynoxide (npm): upgrade to 0.9.13 or later

  ```sh
  npm install dynoxide@0.9.13
  ```


## Technical details

The rmcp crate's Streamable HTTP server transport (prior to version 1.4.0) does not validate the incoming HTTP 'Host' header. This oversight allows for DNS rebinding attacks where a malicious public website can resolve to a victim's loopback (127.0.0.1) or private IP address, bypassing the Same-Origin Policy. An attacker can then send authenticated requests to the MCP server to enumerate tools, read resources, or trigger side effects like shell execution. The vulnerability is fixed in version 1.4.0 by implementing a default allowlist for the Host header (localhost, 127.0.0.1, ::1) and providing a validation middleware.

## Affected products

- modelcontextprotocol rmcp < 1.4.0

## Identifiers

- CVE-2026-42559
- GHSA-89vp-x53w-74fx
- GHSA-fvh2-gm75-j4j7
- RUSTSEC-2026-0140
- RUSTSEC-2026-0189

## Timeline

- 2026-04-09: patched: Version 1.4.0 released
- 2026-04-29: disclosed: Advisory published on GitHub
- 2026-05-06: advisory: GitHub Advisory reviewed and published to database
- 2026-05-14: kev added: NVD publication date

## References

- [https://api.github.com/users/JLLeitschuh](https://api.github.com/users/JLLeitschuh)
- [https://github.com/JLLeitschuh](https://github.com/JLLeitschuh)
- [https://api.github.com/users/JLLeitschuh/gists%7B/gist_id%7D](https://api.github.com/users/JLLeitschuh/gists%7B/gist_id%7D)
- [https://api.github.com/users/JLLeitschuh/repos](https://api.github.com/users/JLLeitschuh/repos)
- [https://avatars.githubusercontent.com/u/1323708?v=4](https://avatars.githubusercontent.com/u/1323708?v=4)
- [https://api.github.com/users/JLLeitschuh/events%7B/privacy%7D](https://api.github.com/users/JLLeitschuh/events%7B/privacy%7D)

## Related threats

- [RUSTSEC-2026-0462 - Unbounded response body buffering in Streamable HTTP clients](https://junglewise.ai/threats/rustsec-2026-0462-unbounded-response-body-buffering-in-streamable-http-3cfaf6d0)
- [rmcp OAuth client SSRF via unresolved hostnames](https://junglewise.ai/threats/rustsec-2026-0457-oauth-client-ssrf-filter-checks-host-strings-not-26bba63d)
- [RUSTSEC-2026-0461 - Unbounded tool schema cache in Streamable HTTP server transport](https://junglewise.ai/threats/rustsec-2026-0461-unbounded-tool-schema-cache-in-streamable-http-server-35418a7a)
- [rmcp OAuth client SSRF via server-controlled resource_metadata URL](https://junglewise.ai/threats/rmcp-oauth-client-fetches-server-controlled-resource-metadata-urls-6efc52a6)
- [Model Context Protocol Rust SDK custom header leak on cross-origin redirects](https://junglewise.ai/threats/cve-2026-64684-model-context-protocol-rust-sdk-custom-header-leak-on-cross)