Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 2 October 2026.

Which products and versions are affected?

rmcp (crates.io) SEMVER:introduced=0,fixed=2.0.0; Modelcontextprotocol Rmcp <= 1.8.0.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run rmcp (crates.io) or Modelcontextprotocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

rmcp OAuth client SSRF via server-controlled resource_metadata URL

Q: Is there a fix for This vulnerability?

Yes. rmcp (crates.io): upgrade to 2.0.0 or later. Until then: Reject or block cross-origin resource_metadata URLs unless explicitly required and protected by private-network access controls. Implement same-origin validation on the URL before fetching, and block requests to loopback (127.0.0.0/8), link-local, RFC 1918, and cloud metadata hostnames. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run rmcp (crates.io) or Modelcontextprotocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-10-02

The rmcp OAuth client library for Rust performs automatic OAuth discovery by fetching metadata from URLs provided by the remote MCP server. An attacker can inject a crafted MCP server that directs the client to fetch URLs pointing to internal services, cloud metadata endpoints, or localhost—exposing sensitive cloud credentials, internal service responses, or enabling further lateral movement from the victim's network position.

Technologies: rmcp (crates.io). Vendors: crates.io, Modelcontextprotocol.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 2 October 2026.
Which products and versions are affected?: rmcp (crates.io) SEMVER:introduced=0,fixed=2.0.0; Modelcontextprotocol Rmcp <= 1.8.0.
Is there a fix for This vulnerability?: Yes. rmcp (crates.io): upgrade to 2.0.0 or later. Until then: Reject or block cross-origin resource_metadata URLs unless explicitly required and protected by private-network access controls. Implement same-origin validation on the URL before fetching, and block requests to loopback (127.0.0.0/8), link-local, RFC 1918, and cloud metadata hostnames. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run rmcp (crates.io) or Modelcontextprotocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rmcp (crates.io): upgrade to 2.0.0 or later
```
cargo update -p rmcp
```

Reject or block cross-origin resource_metadata URLs unless explicitly required and protected by private-network access controls. Implement same-origin validation on the URL before fetching, and block requests to loopback (127.0.0.0/8), link-local, RFC 1918, and cloud metadata hostnames.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the rmcp crate's OAuth authentication handler. The client parses a resource_metadata URL from the WWW-Authenticate response header without validating that it is same-origin with the MCP server, nor does it block loopback, RFC 1918, or cloud metadata hostnames. An attacker-controlled MCP server can respond with a malicious 401 WWW-Authenticate header pointing to internal URLs; the client will fetch them from the victim's network context with no validation.

Affected products

Modelcontextprotocol rmcp <= 1.8.0

Timeline

2026-10-02: disclosed: Advisory published
2026-06-29: patched: rmcp 2.0.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.