Evidence · DiggingBeagle record
RustSec RUSTSEC-2026-0457 rmcp OAuth discovery SSRF
Security advisory for MCP OAuth client hostname validation and discovery fetch.
- Published
- Nov 9, 2026
- Source role
- primary disclosure
Evidence record
Security advisory for MCP OAuth client hostname validation and discovery fetch.
Claim-level citations (3)
- supportsRust MCP OAuth metadata fetch trusted names without resolving private destinations: RustSec documents name-string validation without a DNS resolution check in rmcp OAuth client metadata retrieval.
Description
- supportsRust MCP OAuth metadata fetch trusted names without resolving private destinations: Affected rmcp versions start at 2.0.0 and the issue is patched at 3.7.0.
Patched and Unaffected version table
- supportsRust MCP OAuth metadata fetch trusted names without resolving private destinations: RustSec identifies rmcp versions from 2.0.0 up to but excluding 3.7.0 as affected and reports the default OAuth client corrected in 3.7.0; custom client constructors need separate enforcement.
RUSTSEC-2026-0457, Patched/Unaffected and Description sections