The Streamable HTTP server transport in the RMCP Rust SDK fails to validate the incoming Host header, enabling a malicious external site to perform a DNS rebinding attack. By resolving a domain to the victim's loopback or private network address, the attacker can send authenticated requests that the server accepts, potentially exposing privileged functionality or executing commands on the host.

This weakness exists in all releases of the rmcp crate prior to version 1.4.0 from the modelcontextprotocol:rust-sdk collection. Any deployment relying on these earlier versions is vulnerable; the fix is delivered in 1.4.0 and later.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, but the nature of the attack relies on an attacker controlling a DNS domain and an accessible internal interface, giving the attack vector a network level. Because the result is unauthorized internal communication, the risk to confidentiality and integrity is significant, and the possibility of exploitation remains; it is not yet listed in KEV.