CVE-2026-63127
1 advisory.
crates.io/rmcp CVE-2026-63127: high 8.2
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
Action: Upgrade rmcp to 2.0.0 or later.
cargo update -p rmcp --precise 2.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.0.0 | - |
Fixed versions
| 2.0.0 |
Sources
- osv: GHSA-33f5-2c5q-wgwj
- https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj
- https://nvd.nist.gov/vuln/detail/CVE-2026-63127
- https://github.com/modelcontextprotocol/rust-sdk/pull/937
- https://github.com/modelcontextprotocol/rust-sdk/commit/c1a8b29ff2cc45e7820b900dae42cbb4958089ec
- https://github.com/modelcontextprotocol/rust-sdk
- https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0
CVE-2026-63127 · published · modified · JSON