CVE-2026-63127High· 8.2▾ MidnightPoC availableRMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oau…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 45.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.2%
0.2% → 0.2%
Last analysed / modified upstream
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-resource metadata without confirming that the returned resource identifier exactly matches the configured MCP server. A malicious MCP server can publish metadata for a different legitimate MCP resource and its authorization server, causing a victim who connects and completes the authorization flow to obtain a legitimate access token that the client subsequently sends to the malicious server. The attacker can capture the token and impersonate the victim against the legitimate MCP resource within the token's granted scopes. This issue is fixed in version 2.0.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
rmcp < 2.0.0Patched in:
rmcp 2.0.0Source: https://github.com/advisories/GHSA-33f5-2c5q-wgwj
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63128High· 7.5RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-64684Medium· 6.8RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-104850High· 7.5MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files
CVE-2026-59951Medium· 6.9The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP)