CVE-2026-63127: RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata (RFC 9728), allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens.
References
- github.com/advisories/GHSA-33f5-2c5q-wgwj
- github.com/modelcontextprotocol/rust-sdk/commit/c1a8b29ff2cc45e7820b900dae42cbb4958089ec
- github.com/modelcontextprotocol/rust-sdk/pull/937
- github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0
- github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj
- nvd.nist.gov/vuln/detail/CVE-2026-63127
Code Behaviors & Features
Detect and mitigate CVE-2026-63127 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →