The rmcp client accepted attacker-specified OAuth discovery hostnames that could resolve to internal or link-local IPs. Entry and authority. A client performs OAuth protected-resource discovery using metadata from an untrusted MCP server. Observed mechanism and consequence. The server identifies an authorization hostname passing string checks but…
Inspect the ClaimsCase · DiggingBeagle record
Rust MCP OAuth metadata fetch trusted names without resolving private destinations
The rmcp client accepted attacker-specified OAuth discovery hostnames that could resolve to internal or link-local IPs.
Public disclosure: Nov 9, 2026
Scope
A client performs OAuth protected-resource discovery using metadata from an untrusted MCP server. The server identifies an authorization hostname passing string checks but resolving to an internal address; the client issues a GET request to that destination.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-RUST-MCP-OAUTH-SSRF; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-RUST-MCP-OAUTH-SSRF-01 · CLM-DB233-RUST-MCP-OAUTH-SSRF-02 · CLM-ENR234-DB233-RUST-MCP-OAUTH-SSRF · RustSec RUSTSEC-2026-0457 rmcp OAuth discovery SSRF
At a glance
This finding establishes SSRF discovery exposure, not confirmed OAuth token theft or arbitrary internal POST access. Related streaming/cache findings are distinct and deferred.
Limits and uncertaintyFull account
The rmcp client accepted attacker-specified OAuth discovery hostnames that could resolve to internal or link-local IPs.
Entry and authority. A client performs OAuth protected-resource discovery using metadata from an untrusted MCP server.
Observed mechanism and consequence. The server identifies an authorization hostname passing string checks but resolving to an internal address; the client issues a GET request to that destination.
Limits and status. This finding establishes SSRF discovery exposure, not confirmed OAuth token theft or arbitrary internal POST access. Related streaming/cache findings are distinct and deferred.
The Rust rmcp OAuth client filtered discovery URL strings rather than resolving hostnames before accepting an authorization-server endpoint. A malicious MCP server could therefore supply a public-looking DNS name resolving to a private address. The advisory also identifies IPv6 literal and unvalidated token/registration endpoint paths. Responses were not automatically relayed to the attacker; cloud-metadata services needing extra headers are not demonstrated targets.
Mechanism and trust boundary
- 01
Precondition and trust context
A client performs OAuth protected-resource discovery using metadata from an untrusted MCP server.
- 02
Crossed boundary
The server identifies an authorization hostname passing string checks but resolving to an internal address; the client issues a GET request to that destination.
- 03
Observed limit
This finding establishes SSRF discovery exposure, not confirmed OAuth token theft or arbitrary internal POST access. Related streaming/cache findings are distinct and deferred.
Timeline
- Nov 9, 2026Event type unspecified
Initial documented finding
Rust MCP OAuth metadata fetch trusted names without resolving private destinations
- Nov 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-RUST-MCP-OAUTH-SSRF-01RustSec documents name-string validation without a DNS resolution check in rmcp OAuth client metadata retrieval.supported
Basis: reported finding
- supportsRustSec RUSTSEC-2026-0457 rmcp OAuth discovery SSRFprimary disclosure
Description
CLM-DB233-RUST-MCP-OAUTH-SSRF-02Affected rmcp versions start at 2.0.0 and the issue is patched at 3.7.0.supported
Basis: reported finding
- supportsRustSec RUSTSEC-2026-0457 rmcp OAuth discovery SSRFprimary disclosure
Patched and Unaffected version table
CLM-ENR234-DB233-RUST-MCP-OAUTH-SSRFRustSec identifies rmcp versions from 2.0.0 up to but excluding 3.7.0 as affected and reports the default OAuth client corrected in 3.7.0; custom client constructors need separate enforcement.supported
Basis: reported finding
- supportsRustSec RUSTSEC-2026-0457 rmcp OAuth discovery SSRFprimary disclosure
RUSTSEC-2026-0457, Patched/Unaffected and Description sections
Controls and mitigations
- Upgrade rmcp to 3.7.0 or later, whose default OAuth client checks resolved addresses and redirects.
- If supplying a custom OAuth HTTP client, enforce equivalent IP and redirect policies; do not assume the library default protects custom client implementations.
Unknowns and contradictions
- This finding establishes SSRF discovery exposure, not confirmed OAuth token theft or arbitrary internal POST access. Related streaming/cache findings are distinct and deferred.
Sources and citation
Material revision history
- Nov 11, 2026 · Published version · first publication · revision 235