CVE-2026-63127: RMCP missing resource field validation in OAuth metadata

CVE-2026-63127 · Severity: high · CVSS 8.2 · Published 2026-09-16

The RMCP Rust library fails to validate the resource identifier field when discovering OAuth authorization servers through protected resource metadata. An attacker can set up a malicious MCP server that claims to represent a legitimate server, tricking clients into obtaining valid access tokens for the legitimate server and then sending them to the attacker's server. This enables account takeover and full impersonation of affected users on the legitimate service.

Technologies: Anthropic Model Context Protocol, rmcp (crates.io). Vendors: Anthropic, crates.io.

Quick answers

Is CVE-2026-63127 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63127 being exploited in the wild.
How severe is CVE-2026-63127?
High severity, with a CVSS score of 8.2, published 16 September 2026.
Which products and versions are affected?
Anthropic Model Context Protocol < 2.0.0; rmcp (crates.io) < 2.0.0, SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2026-63127?
Yes. rmcp (crates.io): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63127 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63127?
Check whether you run Anthropic Model Context Protocol or rmcp (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rmcp (crates.io): upgrade to 2.0.0 or later
    cargo update -p rmcp

Technical details

The vulnerability is an insufficient verification of data authenticity (CWE-345) in OAuth Protected Resource metadata discovery, violating RFC 9728 requirements. The ResourceServerMetadata struct in crates/rmcp/src/transport/auth.rs lacks a resource field and the discover_oauth_server_via_resource_metadata() function performs no validation that the resource URL claimed in fetched metadata matches the URL actually being accessed. An attacker hosting a malicious MCP server can serve OAuth metadata claiming to represent a legitimate MCP server, causing rmcp clients to complete OAuth authorization with the legitimate server's authorization endpoint and then forward the resulting valid access tokens to the attacker's server. This requires user interaction (completing an authorization flow) but no privileges. The attack is exploitable over the network. Patch version 2.0.0 adds the missing resource field validation as specified in RFC 9728 sections 3.3 and 7.3.

Affected products

  • Model Context Protocol RMCP < 2.0.0

Identifiers

  • CVE-2026-63127
  • GHSA-33f5-2c5q-wgwj

Timeline

  • 2026-06-29: disclosed: Advisory published by GitHub
  • 2026-06-27: patched: Fix merged in PR #937 to rmcp v2.0.0
  • 2026-09-16: advisory: Published to NVD and GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.