# rmcp OAuth client SSRF via server-controlled resource_metadata URL

Source: https://junglewise.ai/threats/rmcp-oauth-client-fetches-server-controlled-resource-metadata-urls-6efc52a6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-04  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-10-02

The rmcp OAuth client library for Rust performs automatic OAuth discovery by fetching metadata from URLs provided by the remote MCP server. An attacker can inject a crafted MCP server that directs the client to fetch URLs pointing to internal services, cloud metadata endpoints, or localhost—exposing sensitive cloud credentials, internal service responses, or enabling further lateral movement from the victim's network position.

Technologies: [rmcp (crates.io)](https://junglewise.ai/threats/technologies/rmcp). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [Modelcontextprotocol](https://junglewise.ai/threats/vendors/modelcontextprotocol).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 2 October 2026.

**Which products and versions are affected?** rmcp (crates.io) SEMVER:introduced=0,fixed=2.0.0; Modelcontextprotocol Rmcp <= 1.8.0.

**Is there a fix for This vulnerability?** Yes. rmcp (crates.io): upgrade to 2.0.0 or later. Until then: Reject or block cross-origin resource_metadata URLs unless explicitly required and protected by private-network access controls. Implement same-origin validation on the URL before fetching, and block requests to loopback (127.0.0.0/8), link-local, RFC 1918, and cloud metadata hostnames. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run rmcp (crates.io) or Modelcontextprotocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rmcp (crates.io): upgrade to 2.0.0 or later

  ```sh
  cargo update -p rmcp
  ```


Reject or block cross-origin resource_metadata URLs unless explicitly required and protected by private-network access controls. Implement same-origin validation on the URL before fetching, and block requests to loopback (127.0.0.0/8), link-local, RFC 1918, and cloud metadata hostnames.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the rmcp crate's OAuth authentication handler. The client parses a resource_metadata URL from the WWW-Authenticate response header without validating that it is same-origin with the MCP server, nor does it block loopback, RFC 1918, or cloud metadata hostnames. An attacker-controlled MCP server can respond with a malicious 401 WWW-Authenticate header pointing to internal URLs; the client will fetch them from the victim's network context with no validation.

## Affected products

- Modelcontextprotocol rmcp <= 1.8.0

## Timeline

- 2026-10-02: disclosed: Advisory published
- 2026-06-29: patched: rmcp 2.0.0 released

## References

- [https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-c9xm-49cp-xcr9](https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-c9xm-49cp-xcr9)
- [https://github.com/modelcontextprotocol/rust-sdk/pull/935](https://github.com/modelcontextprotocol/rust-sdk/pull/935)

## Related threats

- [RUSTSEC-2026-0462 - Unbounded response body buffering in Streamable HTTP clients](https://junglewise.ai/threats/rustsec-2026-0462-unbounded-response-body-buffering-in-streamable-http-3cfaf6d0)
- [rmcp OAuth client SSRF via unresolved hostnames](https://junglewise.ai/threats/rustsec-2026-0457-oauth-client-ssrf-filter-checks-host-strings-not-26bba63d)
- [RUSTSEC-2026-0461 - Unbounded tool schema cache in Streamable HTTP server transport](https://junglewise.ai/threats/rustsec-2026-0461-unbounded-tool-schema-cache-in-streamable-http-server-35418a7a)
- [Model Context Protocol Rust SDK custom header leak on cross-origin redirects](https://junglewise.ai/threats/cve-2026-64684-model-context-protocol-rust-sdk-custom-header-leak-on-cross)
- [RMCP Streamable HTTP server unauthenticated session-table memory leak](https://junglewise.ai/threats/cve-2026-63128-rmcp-streamable-http-server-unauthenticated-session-table-memory)