Secuno
ENNL
Book demo

CVE-2026-63127

8.2 HIGH
  1. Published16 Sept 2026

Description

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-resource metadata without confirming that the returned resource identifier exactly matches the configured MCP server. A malicious MCP server can publish metadata for a different legitimate MCP resource and its authorization server, causing a victim who connects and completes the authorization flow to obtain a legitimate access token that the client subsequently sends to the malicious server. The attacker can capture the token and impersonate the victim against the legitimate MCP resource within the token's granted scopes. This issue is fixed in version 2.0.0.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-542398.8
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin…
CVE-2026-860398.2
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until…
CVE-2026-269508.1
Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient…
CVE-2026-615918.1
djust provides Phoenix LiveView-style reactive server-side rendering for Django with…
CVE-2026-885929.1
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The…
CVE-2026-734358.2
On affected platforms running Arista EOS with Open Shortest Path First version 2…

Frequently asked

Is CVE-2026-63127 being actively exploited?

CVE-2026-63127 is not in the CISA KEV catalog.

How severe is CVE-2026-63127?

CVE-2026-63127 has a CVSS 3.1 base score of 8.2, rated high.

How do I fix CVE-2026-63127?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-63127 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.