rmcp OAuth client SSRF via server-controlled resource_metadata URL

The rmcp OAuth client accepts and fetches server-controlled resource_metadata URLs from WWW-Authenticate headers without validation, allowing attackers to perform SSRF attacks against internal services from the victim application's network context.

Disclosed 2 October 2026 · Record updated 2 October 2026

Impact

SSRF vulnerability allowing attackers to probe internal services and potentially chain into additional authorization-server metadata fetches through attacker-controlled or compromised MCP servers

Our coverage

A puppet master yanks invisible strings attached to a messenger's arms, forcing it to fetch packages from unmarked doorways in the fog.

Vulnerabilities

rmcp OAuth client fetches attacker-chosen URLs, advisory warns

A GitHub security advisory published on 2 October 2026 says the Rust MCP SDK's OAuth client will fetch any URL an MCP server names in an authentication header.

2 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-c9xm-49cp-xcr9