CVE-2026-42559

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

• CWE-346
• CWE-350

• https://github.com/modelcontextprotocol/rust-sdk/commit/8e22aa2de28df5a285eed87c11cd89bf15fa90d3
• https://github.com/modelcontextprotocol/rust-sdk/issues/815
• https://github.com/modelcontextprotocol/rust-sdk/issues/822
• https://github.com/modelcontextprotocol/rust-sdk/pull/764
• https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42553Cinny is a Matrix client. Prior to 4.10.3, A remote authenti…7.1
• CVE-2026-42554Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0,…6.1
• CVE-2026-42555Valtimo is an open-source business process automation platfo…9.1
• CVE-2026-42556Postiz is an AI social media scheduling tool. From version 2…9
• CVE-2026-42557jupyterlab is an extensible environment for interactive and …9.6
• CVE-2026-42558Xibo is an open source digital signage platform with a web c…7.6
• CVE-2026-4256Improper neutralization of special elements used in an LDAP …8.2
• CVE-2026-42560auth provides authentication via oauth2, direct and email. F…9.1
• CVE-2026-42561Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-42562Plainpad is a self hosted note taking app. Prior to version …8.3
• CVE-2026-42563Dulwich is a pure-Python implementation of the Git file form…7.7
• CVE-2026-42564jotty·page is a self-hosted app for your checklists and note…8.2