{
 "id": "AIR-2026-1075",
 "slug": "cve-2026-42559-rmcp-streamable-http-server-host-header-valid",
 "title": "CVE-2026-42559: RMCP Streamable HTTP Server Host Header Validation Flaw",
 "summary": "Prior to version 1.4.0, the RMCP crate's Streamable HTTP server transport lacked Host header validation, permitting DNS rebinding attacks. This allowed malicious websites to send authenticated requests to local or private MCP servers.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "RMCP",
  "Model Context Protocol"
 ],
 "incident_date": "2026-05-14",
 "incident_date_precision": "day",
 "first_reported": "2026-05-14",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42559",
   "publisher": "NVD",
   "title": "CVE-2026-42559: RMCP is an official Rust SDK for the Model Context Protocol.",
   "published_at": "2026-05-14"
  }
 ],
 "source_count": 1,
 "confidence": 0.9,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-42559",
  "dns-rebinding",
  "model-context-protocol"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}