Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 22 October 2026.

Which products and versions are affected?

rmcp (crates.io) SEMVER:introduced=2.0.0,fixed=3.7.0; Model Context Protocol Rmcp 2.0.0 to 3.6.x.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run rmcp (crates.io) or Model Context Protocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

rmcp OAuth client SSRF via unresolved hostnames

Severity: info · Published 2026-10-22

rmcp is a Rust library for OAuth client authentication in Model Context Protocol applications. The library's SSRF filter bypassed checks by validating only hostname strings without resolving them to IP addresses, allowing attackers to craft hostnames that resolve to internal network addresses. An attacker controlling a malicious server could trick the client into making HTTP requests to internal services, potentially exposing or compromising sensitive data or services on private networks.

Technologies: rmcp (crates.io). Vendors: crates.io, Model Context Protocol.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 22 October 2026.
Which products and versions are affected?: rmcp (crates.io) SEMVER:introduced=2.0.0,fixed=3.7.0; Model Context Protocol Rmcp 2.0.0 to 3.6.x.
Is there a fix for This vulnerability?: Yes. rmcp (crates.io): upgrade to 3.7.0 or later. Until then: Deployments that reach their authorization server through a hostname resolving to a private address should use AuthorizationManager::new_allowing_private_addresses. Clients supplied through new_with_oauth_http_client must enforce their own outbound address policy. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run rmcp (crates.io) or Model Context Protocol Rmcp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rmcp (crates.io): upgrade to 3.7.0 or later
```
cargo update -p rmcp
```

Deployments that reach their authorization server through a hostname resolving to a private address should use AuthorizationManager::new_allowing_private_addresses. Clients supplied through new_with_oauth_http_client must enforce their own outbound address policy.

Technical details

The rmcp OAuth client (versions 2.0.0 through 3.7.0) performed SSRF filtering on hostnames without DNS resolution, rejecting only literal IP addresses and known metadata service names. An attacker can provide a hostname that resolves to a private, loopback, or link-local address to bypass the filter. Additionally, IPv6 literals in brackets were not properly parsed, and token_endpoint and registration_endpoint fields from authorization server metadata were unchecked, allowing redirects to internal addresses. The vulnerability requires a malicious MCP server or authorization server but is easily exploited through DNS manipulation.

Affected products

Model Context Protocol rmcp 2.0.0 to 3.6.x

Identifiers

GHSA-5p52-q7pq-9fq2
GHSA-c9xm-49cp-xcr9
RUSTSEC-2026-0457

Timeline

2026-10-22: disclosed
2026-11-09: advisory
2026-11-09: patched: Version 3.7.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.