Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-63127— RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

Quick assessment

Affected
modelcontextprotocol rust-sdk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RMCP 是模型上下文协议（Model Context Protocol, MCP）的官方 Rust SDK。在 2.0.0 版本之前， crate 位于 中的 OAuth 实现存在以下缺陷： 中省略了 RFC 9728 定义的 字段，并且 函数在使用受保护资源元数据时，未验证返回的资源标识符是否与配置的 MCP 服务器完全匹配。 因此，一个恶意的 MCP 服务器可以发布针对另一个合法的 MCP 资源及其授权服务器的元数据，导致完成授权流程的用户（受害者）获得一个合法的资源访问令牌，而客户端随后将该令牌发送给了这个

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63127

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
Source: CVE Program / CVE List V5
Vulnerability Description
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-resource metadata without confirming that the returned resource identifier exactly matches the configured MCP server. A malicious MCP server can publish metadata for a different legitimate MCP resource and its authorization server, causing a victim who connects and completes the authorization flow to obtain a legitimate access token that the client subsequently sends to the malicious server. The attacker can capture the token and impersonate the victim against the legitimate MCP resource within the token's granted scopes. This issue is fixed in version 2.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
modelcontextprotocol rust-sdk < 2.0.0 -

II. Public POCs for CVE-2026-63127

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63127

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63127 (2)

Vendor Pages for CVE-2026-63127 (1)

Other References for CVE-2026-63127 (1)

IV. Related Vulnerabilities

Same product: rust-sdk
Same vendor: modelcontextprotocol
Same weakness: CWE-345

V. Comments for CVE-2026-63127

No comments yet

Leave a comment