## Summary The `rmcp` OAuth client accepts a server-controlled `resource_metadata=` URL from the `WWW-Authenticate` header and fetches it without same-origin or private-network validation. An attacker-controlled MCP server can return a `401 WWW-Authenticate: Bearer resource_metadata="..."` header pointing at an internal URL, including localhost, RFC 1918 addresses, or cloud metadata endpoints. The client then performs an outbound GET to that URL from the victim application's network context. ## Affected version - Repository: `modelcontextprotocol/rust-sdk` - Crate: `rmcp` - Current `main` reviewed: `c330fede90e4729c234f8e87fdbc5ea27a1dd10c` - Commit date: 2026-05-19 - Affected file: `crates/rmcp/src/transport/auth.rs` - File blob: `3aa3e91310662c409af9dc38c9d584d6df217e9c` - Severity framing: High/Medium SSRF, depending on the embedding application's network position and whether response parsing gives the attacker useful success/failure or chained fetch behavior. ## Source evidence `extract_www_authenticate_params()` accepts an absolute URL from the server-controlled header: ```rust let resource_key = "resource_metadata="; while let Some(pos) = header_lowercase[search_offset..].find(resource_key) { let global_pos = search_offset + pos + resource_key.len(); let value_slice = &header[global_pos..]; if let Some((value, consumed)) = Self::parse_next_header_value(value_slice) { if let Ok(url) = Url::parse(&value) { params.resource_metadata_url = Some(url); break; } if let Ok(url) = base_url.join(&value) { params.resource_metadata_url = Some(url); break; } ``` There is no check that the parsed URL shares origin with the original MCP server, and no block for loopback, link-local, RFC 1918, or metadata hostnames. `fetch_resource_metadata_from_url()` then performs the GET: ```rust let response = match self .http_client .get(resource_metadata_url.clone()) .header(HEADER_MCP_PROTOCOL_VERSION, "2024-11-05") .send() .await ``` Again, there is no same-origin, scheme, host, DNS, or IP-range validation before the request. ## Attack scenario 1. A Rust MCP client using `rmcp` connects to an attacker-controlled MCP server, or to a compromised MCP server. 2. The server responds to OAuth discovery with a `401` and a `WWW-Authenticate` header such as: ```text WWW-Authenticate: Bearer resource_metadata="http://169.254.169.254/latest/meta-data/" ``` 3. The client parses the `resource_metadata` value as a URL. 4. The client sends a GET request to that URL from the victim application's network context. This can be used to probe internal services. In environments where the target endpoint returns JSON matching the expected metadata shape, the flow can also chain into additional authorization-server metadata fetches. ## Impact The direct impact is SSRF from any application embedding the rmcp OAuth client. Depending on where the client runs, this can reach: - cloud metadata endpoints; - localhost-only services; - private VPC or container-network services; - internal HTTP APIs not reachable from the attacker. The attacker controls the URL through the MCP server response. The victim only needs to connect to the attacker's MCP server or a compromised server that can emit the crafted `WWW-Authenticate` header. ## Public duplicate check On 2026-05-27: - Visible repository advisories were: - `GHSA-9g45-5xwm-f3wc`: custom HTTP headers leak to cross-origin redirect targets. - `GHSA-89vp-x53w-74fx`: DNS rebinding in Streamable HTTP server transport. - Public issue search for `WWW-Authenticate resource_metadata SSRF` returned no open or closed matches. - Public issue search for `resource_metadata` returned one closed implementation issue, `#517`, about authorization discovery fallback behavior, not SSRF/resource validation. This report is distinct from the redirect-header advisory and the DNS-rebinding advisory. ## Suggested fix Before accepting or fetching a `resource_metadata` URL: - require the URL to be same-origin with the original MCP server URL, unless the spec intentionally permits a narrow trusted exception; - reject loopback, link-local, RFC 1918, unique-local IPv6, and known cloud metadata hostnames; - reject non-HTTP(S) schemes; - apply the same validation to redirect targets and any follow-on metadata URLs. A minimal same-origin check would compare scheme, host, and effective port: ```rust fn is_same_origin(base: &Url, candidate: &Url) -> bool { base.scheme() == candidate.scheme() && base.host() == candidate.host() && base.port_or_known_default() == candidate.port_or_known_default() } ``` If cross-origin `resource_metadata` is required for compatibility, it should be explicitly opted into and protected by private-network blocking.
PoC: CVE-2026-112445
CVE-2026-112445: The Simplest macOS Local Privilege Escalation to Date
PoC: CVE-2026-43664
AirPods Bluetooth MAC Address Disclosure via NSUserDefaults
PoC: OtherActivityToken
Exploit for CVE-2025-0098, Activity token leak due to pid-only check and then use of that token for arbitrary startActivity()
PoC: CVE-2026-112706-CoreMedia-fd-leak
Independent discovery & coordinated disclosure: CoreMedia bytestream XPC (mediaplaybackd) vended live file descriptors for protected paths to any sandboxed app on iOS 26.5–27.0.1. Fixed in iOS 27.2 as CVE-2026-112706. PoC + evidence.
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-98260-vivo-x-fold6-poc
CVE 2026 98260 vivo x fold6 poc
PoC: CVE-2026-98260-PMX110-Root618-Jailbreak
CVE-2026-98260 (exec: posix timer UAF) LKM jailbreak for OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110): one-command root via shell uid 2000, with KernelSU / FinaSU / SukiSU / KernelSU-Next handover. Release build Root618 1.5.12 (R8-obfuscated).
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: brotli-node2shell-check
Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder
PoC: php2shell-lab
Lab reproduction, exposure probe and detection content for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell). Defensive research; no exploit.
PoC: cve-2026-98432-audit
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
PoC: php2shell-poc
CLI scanner and PoC for CVE-2026-109618 / CVE-2026-109619 (PHP OOM heap corruption and session upload-progress injection, CVSS 9.2). Affects PHP 5.4.0-8.5.11; patched in 8.2.35, 8.3.36, 8.4.27, 8.5.12. No external dependencies.
PoC: CVE-2026-88804
PoC CVE-2026-88804 (Rancher)
PoC: php2shell-poc
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
PoC: CVE-2026-98260-dada-android
Verified CVE-2026-98260 Android port for Xiaomi 15 dada OS4.0.0.22.XOCCNXM
PoC: CVE-2025-4960
Local Privilege Escalation via Improper Authorization Handling in EPSON Printer Controller Installer
PoC: ghostlock-kirkwood
CVE-2026-43499 (GhostLock) port for the Google TV Streamer (kirkwood / MT8696): single-file, per-boot temporary root + interactive root shell, with a build-matching case study and adaptation guide.
PoC: node2shell
Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security
PoC: CVE-2026-97555
CVE-2026-97555: heap overflow in the Linux SMB client DACL rewrite (cifs.ko) — analysis, POC, and an arm64 exploit chain ending in a uid-0 credential overwrite on the reference build
PoC: cve-2026-110311-gitea-lab
Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report.
PoC: nginx-rift-cve-2026-42945-lab
Interactive NGINX CVE-2026-42945 educational simulation built with HTML, CSS, and JavaScript. Features vulnerable and patched modes, synthetic request inspection, memory visualization, event logging, and security recommendations. No real exploit execution.
PoC: CVE-2026-12118-POC-
POC for CVE-2026-12118
PoC: CVE-2026-104286
Exploit for CVE-2026-104286 — FortiMail: Unauthenticated Arbitrary File Write → Code Execution
PoC: node2shell
Scanner to checking (CVE-2026-111497) vulnerability
PoC: PHP2Shell
CVE-2026-109618 & CVE-2026-109619 — Pre-Auth RCE in PHP Core (session.upload_progress). Scanner, exploit verifier, and full technical analysis.
PoC: CVE-2026-50053
Offline Python detector for CVE-2026-50053 version exposure in Zimbra Collaboration Suite.
PoC: CVE-2026-115889
Offline Python detector for CVE-2026-115889 version exposure in Wasmtime.
PoC: CVE-2026-53921
Offline Python source-pattern auditor for CVE-2026-53921 in odhcpd.
PoC: gitlab-rce-toolkit
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
PoC: CVE-2026-101259
Reproducer for CVE-2026-101259 — Apache Camel camel-coap consumer sent the exception message to the CoAP client as a 5.00 payload (CWE-209). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-71569
Reproducer for CVE-2026-71569 — Apache Camel camel-a2a push-notification webhook guard accepted an IPv6 unique local address (fc00::/7) reached through a host name (CWE-918). Camel Spring Boot + Camel Quarkus.
PoC: RDPBleed
CVE-2026-56190 - Windows RDP Server Uninitialized Resource leads to RCE
PoC: CVE-2026-94386
Reproducer for CVE-2026-94386 — Apache Camel camel-oauth cross-scope token reuse via a JVM-global token cache keyed only on endpoint+clientId (CWE-524). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95629
Reproducer for CVE-2026-95629 — Apache Camel camel-docling passed the CamelDoclingOutputFilePath header to docling's --output verbatim (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: php2shell-advisory-response
PHP2Shell (CVE-2026-109618 / CVE-2026-109619) advisory response: inventory, patch, Wazuh hunt mapping, attestation outline.
PoC: CVE-2026-95628
Reproducer for CVE-2026-95628 — Apache Camel camel-docling custom-argument path validation did not reject absolute paths, an incomplete fix of CVE-2026-40047 (CWE-22). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-95663
Reproducer for CVE-2026-95663 — Apache Camel camel-keycloak served a cached token introspection result past the token's expiry (CWE-613). Camel Spring Boot + Camel Quarkus.
PoC: CVE-2026-97798_LPE_Windows
CVE-2026-97798 PoC — WER Time Travel Debugging argument injection to SYSTEM (Windows 11 LPE), with an adaptive faultrep.dll resolver.
PoC: CVE-2026-95664
Reproducer for CVE-2026-95664 — Apache Camel camel-aws2-s3 evaluated a header-supplied object key as a Simple expression (CWE-917). Camel Spring Boot + Camel Quarkus.
PoC: woff2shell
poc of CVE-2026-111497 delivered as a WOFF2 file
PoC: wiz-bulb-tool
WiZ smart bulb LAN security tool - auto-discovery, CVE-tagged audit, intel recon & device control. Extends CVE-2019-18980 to new hardware. No credentials required.
PoC: CVE-2026-90885
Reproducer for CVE-2026-90885 — Apache Camel camel-saxon XQuery XML External Entity via an already-built javax.xml.transform.Source (CWE-611, HIGH). Camel Spring Boot + Camel Quarkus.
PoC: cve-2026-109618-cve-2026-109619-poc
pHp2Shell CVE 2016 109618 - 109619
PoC: php2shell
Realistic multi-version lab + toolkit for the PHP php2shell pre-auth RCE (CVE-2026-109618/109619): detect, blindly prove, and understand it. No shared mounts, no planted files, no LFI.
PoC: secure-api-cve-2024-23897
Work 1 — secure Flask REST API, three-stage CI, and CVE-2024-23897 (Jenkins CLI) analysis
PoC: charla-php2shell
PHP2Shell (CVE-2026-109618/109619): demos reproducibles y guia de parcheo paso a paso.
PoC: PHP2shell
CVE-2026-109618_CVE-2026-109619
PoC: waffers
The layer that protects you. Proactive defense-in-depth Web Application Firewall mitigating recent critical PHP engine vulnerabilities including PHP2Shell (CVE-2026-109618/9), PHP-CGI Argument Injection (CVE-2024-4577), iconv Filter Chains (CVE-2024-2961), and stream wrapper abuse.
PoC: node2shell-inventory-scanner
Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.
PoC: php2shell-check
A Claude Skill that passively checks whether a website (and optionally its subdomains) runs PHP, confirms the version where possible, and flags exposure to PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-98260-GhostKey
GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）
PoC: CVE-2026-97631-PoC
An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service (DoS) and memory corruption.
PoC: practica-integradora-ciberseguridad
Práctica Integradora de Ciberseguridad (Comisión 1) - Investigación, análisis técnico y laboratorio práctico de CVE-2021-41773 (Apache HTTP Server)
PoC: node2shell-audit
Read-only audit for Node2Shell (CVE-2026-111497): Node.js/Bun Brotli decoder out-of-bounds write
PoC: cve-2026-111497-wordpress-poc
CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress
PoC: demo-zip-rce-sandbox
Live demo: the same vulnerable Rust zip crate (RUSTSEC-2026-0367 setuid + CVE-2026-115905 zip cloaking) contained by a deny-by-default Cosmonic WebAssembly sandbox.
PoC: php2leak
Remote Zend MM ASLR leak testbed (PHP CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-101767-research
Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)
PoC: threat-intelligence-log4shell-analysis
Cybersecurity research project analyzing threat intelligence feeds, Log4Shell (CVE-2021-44228), attack progression, remediation, incident response, and threat hunting.
PoC: CVE-2026-15723
Offline Python detector for CVE-2026-15723 version exposure in self-managed GitLab CE/EE, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-105014
Offline Python applicability detector for CVE-2026-105014 in Azure Pipelines, with strict CSV/JSON inventories and auditable reports.
PoC: CVE-2026-114625
Offline Python detector for CVE-2026-114625 exposure in on-premises VeloCloud Orchestrator, with train-specific build checks and auditable reports.
PoC: CVE-2026-97785
Offline Python applicability detector for CVE-2026-97785 in Microsoft Entra application proxy, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-83938
Offline Python applicability detector for CVE-2026-83938 in Azure Kubernetes Configuration Service, with CSV/JSON inventories and auditable reports.
PoC: CVE-2026-110063
Offline Python applicability detector for CVE-2026-110063 in Azure VM Inspector, with strict CSV/JSON inventories and auditable reports.
PoC: php56-amzn1-security
Security-patched php56 RPMs for Amazon Linux 1 (AMI 2018.03): PHP2Shell (CVE-2026-109618, CVE-2026-109619) and post-5.6.40 fixes backported from deb.sury.org
PoC: CVE-2026-109618-exploit
[PHP2Shell] Golang exploit for CVE-2026-109618 / CVE-2026-109619: Unauthenticated RCE in PHP 5.4–8.5.11 via OOM corruption + session.upload_progress UAF
PoC: CVE-2026-93903
Security advisory for CVE-2026-93903 affecting LiteSpeed Web Server.
PoC: s25u-ghostlock-kernelsu-lkm
Galaxy S25 Ultra (SM-S9380): GhostLock/CVE-2026-43499 memory-only root + KernelSU LKM via kallsyms prelink; Zygisk findings
PoC: cve-2026-98260-uaf
CVE-2026-98260 (posix-cpu-timers exec UAF) exploit research: S9280 Android 14 GKI 6.1 — UAF trigger + zero-write primitive + SELinux Permissive. Handoff doc in HANDOFF.md
PoC: copy-fail-CVE-2026-31431-aarch64
Linux 4.19 aarch64 PoC for CVE-2026-31431 (Copy Fail) - AF_ALG/authencesn page-cache write
PoC: aia-pdfjs-poc
CVE-2024-4367 PDF.js FontMatrix PoC - authorized pentest artifact
PoC: CVE-2025-10035
CVE-2025-10035 is a critical vulnerability in Fortra GoAnywhere MFT that may allow attackers to execute commands remotely on a vulnerable server.
PoC: CVE-2026-35223-Joomla-Access-Control
Proof of Concept for CVE-2026-35223 – Joomla Improper Access Control
PoC: php2shell-audit
Non-intrusive detector for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) - scans codebases and live hosts for vulnerable PHP versions and risky config. Detection, not exploitation.
PoC: TimerRoot
Android front end for CVE-2026-98260: root shell + KernelSU late-load through Shizuku
PoC: php2shell-fixed-images
Reproducible RHITE fixed PHP runtime images for CVE-2026-109618 and CVE-2026-109619
PoC: php-worker-pin
Multi-worker exploitation of the PHP 8.5 OOM-to-RCE chain (CVE-2026-109618/109619): pool pinning, measured
PoC: PHP2SHELL-Lab
Laboratorio para detectar y explotar las vulnerabilidades CVE-2026-109618 y CVE-2026-109619
PoC: CVE-2026-79397-Authenticated-OS-Command-Injection-in-ONT-4GE-RFDW-Ping-Diagnostics
Authenticated OS command injection in ONT-4GE-RFDW’s Ping diagnostics exploitable via default credentials.
PoC: rw-salon
CVE-2024-4442
PoC: rw-tutor
CVE-2024-4223
PoC: CVE-2026-111497-DOS-
CVE-2026-111497 DOS
PoC: rw-stock
CVE-2024-36779
PoC: php2shell-nse-scanner
Advanced Nmap Scripting Engine (NSE) script designed to identify PHP2Shell vulnerabilities (CVE-2026-109618 / CVE-2026-109619). Features multi-layer Black-Box analysis resilient against WAF, proxies, and header stripping.
PoC: rw-web-directory-free
CVE-2024-3552
PoC: cve-2025-27740
Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services
PoC: rw-country-state-city-auto-dropdown
cve-2024-3495
PoC: rw-fluentform
CVE-2024-2771
PoC: CVE-2023-42824
PoC / exploit archive for CVE-2023-42824
PoC: CVE-2024-4443
PoC / exploit archive for CVE-2024-4443
PoC: CVE-2024-7120
PoC / exploit archive for CVE-2024-7120
PoC: CVE-2024-8503
PoC / exploit archive for CVE-2024-8503
PoC: CVE-2025-24000
PoC / exploit archive for CVE-2025-24000
PoC: CVE-2025-30567
PoC / exploit archive for CVE-2025-30567
PoC: CVE-2025-54726
PoC / exploit archive for CVE-2025-54726
PoC: CVE-2025-58443
PoC / exploit archive for CVE-2025-58443
PoC: CVE-2026-19632
PoC / exploit archive for CVE-2026-19632
PoC: CVE-2026-31635
PoC / exploit archive for CVE-2026-31635
PoC: node2shell-status
Node2Shell / Broccoli2Shell (CVE-2026-111497) vendor and Linux distro status - AI-generated, verify before acting
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free