Vendor

Modelcontextprotocol

2 briefs RSS

SSRF Vulnerability in Model Context Protocol Server Packages

A server-side request forgery (SSRF) vulnerability in the Fetch Tool component of the Model Context Protocol server packages allows remote attackers to perform unauthorized requests.

mcp-server-fetch +1 web-vulnerability ssrf

1c Oct 2, 2026

high advisory

rmcp Streamable HTTP Server Transport DNS Rebinding Vulnerability

2 rules 1 TTP 1 CVE

The `rmcp` crate before v1.4.0 is vulnerable to DNS rebinding attacks via the Streamable HTTP server transport due to missing Host header validation, potentially allowing arbitrary code execution on a victim's machine if they visit a malicious website.

PoC rmcp +2 dns-rebinding vulnerability http attack

2r 1t 1c updated 5d ago