VDB
RHSA-2026:80764
RHSA-2026:80764
PUBLISHED
CVSS 7.300000190734863 HIGH
A flaw was found in rmcp, a Rust SDK for the Model Context Protocol. The OAuth implementation in rmcp omits the RFC 9728 resource field from ResourceServerMetadata. This allows a malicious Model Context Protocol (MCP) server to publish metadata for a different legitimate MCP resource. Consequently, a victim connecting to the malicious server may obtain a legitimate access token, which the client then sends to the malicious server. This enables the attacker to capture the token and impersonate the victim against the legitimate MCP resource within the token's granted scopes, leading to unauthorized access and information disclosure.
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | goose-0:1.45.0-1.el9_8.src as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debugsource-0:1.45.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debugsource-0:1.45.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debuginfo-0:1.45.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-0:1.45.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debuginfo-0:1.45.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debuginfo-0:1.45.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-0:1.45.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debuginfo-0:1.45.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debugsource-0:1.45.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-0:1.45.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-0:1.45.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
| Red Hat | goose-debugsource-0:1.45.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux Extensions Channel (v. 9) | 1.45.0-1.el9 |
Timeline
- Oct 12, 2026 CVE Published
- Oct 12, 2026 CVE Updated
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:80764 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://issues.redhat.com/browse/RHEL-254952 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80764.json advisory
- https://access.redhat.com/security/cve/CVE-2026-63127 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535503 issue
- https://www.cve.org/CVERecord?id=CVE-2026-63127 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63127 advisory
- https://github.com/modelcontextprotocol/rust-sdk/commit/c1a8b29ff2cc45e7820b900dae42cbb4958089ec advisory
- https://github.com/modelcontextprotocol/rust-sdk/pull/937 advisory
- https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0 advisory
- https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj advisory
- https://access.redhat.com/security/cve/CVE-2026-63128 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535485 issue
- https://www.cve.org/CVERecord?id=CVE-2026-63128 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63128 advisory
- https://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846 advisory
- https://github.com/modelcontextprotocol/rust-sdk/pull/934 advisory
- https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh advisory
- https://access.redhat.com/security/cve/CVE-2026-72718 advisory
…and 12 more