MCP Rust SDK (rmcp) vulnerabilities and CVEs
The Beam CVE database tracks 5 security advisories for MCP Rust SDK (rmcp): 3 high and 2 medium severity. The newest is GHSA-c9xm-49cp-xcr9, published Oct 2, 2026 and fixed in 2.0.0.
The official Rust SDK for MCP, published as the rmcp crate.
Check your version: cargo tree -i rmcp
- Vulnerabilities tracked
- 5
- Critical
- 0
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 1
All entries, newest first
GHSA-c9xm-49cp-xcr9
rmcp OAuth client fetches server-controlled resource_metadata URLs
medium6.3Oct 2, 2026CVE-2026-64684
RMCP: Custom HTTP headers leak to cross-origin redirect targets
medium6.8Sep 17, 2026CVE-2026-63127
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
high8.2Sep 16, 2026CVE-2026-63128
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
high7.5Sep 16, 2026CVE-2026-42559
rmcp Streamable HTTP server transport has a DNS rebinding vulnerability
high8.8May 6, 2026