CVE-2026-63127 Overview
CVE-2026-63127 is an authorization flaw in the rmcp crate, the official Rust SDK for the Model Context Protocol (MCP). Versions prior to 2.0.0 omit the RFC 9728 resource field from ResourceServerMetadata and fail to verify that the resource identifier returned by protected-resource metadata matches the configured MCP server. A malicious MCP server can advertise metadata pointing at a different legitimate MCP resource and its authorization server. A victim who completes the OAuth flow then sends a valid access token to the attacker-controlled endpoint. This weakness is classified under [CWE-345: Insufficient Verification of Data Authenticity].
Critical Impact
An attacker can capture a victim's legitimate OAuth access token and impersonate the victim against the real MCP resource within the token's granted scopes.
Affected Products
- rmcp crate (Rust SDK for Model Context Protocol) versions prior to 2.0.0
- Applications embedding crates/rmcp/src/transport/auth.rs OAuth discovery flow
- MCP clients using discover_oauth_server_via_resource_metadata
Discovery Timeline
- 2026-09-16 - CVE-2026-63127 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-63127
Vulnerability Analysis
The rmcp OAuth client implements protected-resource metadata discovery as described in RFC 9728. During discovery, the client fetches metadata from an MCP server and uses the referenced authorization server to obtain an access token. The client never confirms that the resource identifier in the returned metadata matches the MCP server the user intended to connect to. Because the resource field is also omitted from the ResourceServerMetadata struct, downstream validation cannot occur. The result is a broken trust binding between the MCP server URL, the authorization server, and the token audience.
Root Cause
The root cause is insufficient verification of data authenticity in crates/rmcp/src/transport/auth.rs. The discover_oauth_server_via_resource_metadata function trusts the metadata document returned by the remote MCP server without cross-checking the advertised resource identifier against the configured server URL. RFC 9728 requires the client to bind the resource identifier to the target it is authenticating against, and the SDK skipped that step.
Attack Vector
An attacker operates a malicious MCP server and publishes protected-resource metadata that references a legitimate third-party MCP resource and its authorization server. A victim configures their rmcp client to connect to the malicious server. The client discovers the metadata, redirects the user to the legitimate authorization server, and the user completes consent believing they are authorizing the real resource. The authorization server issues a token scoped to the legitimate resource, but the rmcp client forwards this token to the malicious MCP endpoint. The attacker replays the token against the legitimate MCP resource, impersonating the victim within the granted scopes. Exploitation requires user interaction to complete the OAuth flow.
No public exploit code is available. For technical details, see the GitHub Security Advisory GHSA-33f5-2c5q-wgwj and the remediation pull request #937.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-63127
Indicators of Compromise
- OAuth access tokens issued for one MCP resource identifier being presented to a different MCP server hostname.
- Outbound connections from developer workstations or agent hosts to unfamiliar MCP server endpoints followed by OAuth authorization redirects.
- Authorization server audit logs showing token issuance to rmcp-based clients with mismatched resource parameters and destination hosts.
Detection Strategies
- Inventory Rust projects and dependencies for rmcp versions below 2.0.0 using cargo tree or SBOM tooling.
- Correlate MCP client connection logs with authorization server token issuance events to identify audience mismatches.
- Monitor for MCP server metadata responses whose resource field does not match the URL the client contacted.
Monitoring Recommendations
- Enable verbose OAuth logging in authorization servers used by MCP resources and alert on unusual client identifiers or redirect URIs.
- Baseline expected MCP server endpoints for each user and flag connections to new or ad-hoc MCP hosts.
- Track Authorization header destinations in outbound proxy logs to detect tokens sent to hosts other than the token audience.
How to Mitigate CVE-2026-63127
Immediate Actions Required
- Upgrade the rmcp crate to version 2.0.0 or later across all Rust projects and rebuild affected binaries.
- Revoke any OAuth access and refresh tokens issued to rmcp clients that connected to untrusted MCP servers before the upgrade.
- Restrict MCP client configurations to an allowlist of trusted MCP server URLs until the upgrade is deployed.
Patch Information
The fix is included in rmcp v2.0.0. See the GitHub release notes and the remediation commit. The patch adds the RFC 9728 resource field to ResourceServerMetadata and requires discover_oauth_server_via_resource_metadata to verify that the returned resource identifier matches the configured MCP server before proceeding.
Workarounds
- Disable OAuth-based MCP server discovery for rmcp clients that cannot be upgraded immediately.
- Manually pin authorization server metadata rather than relying on protected-resource discovery from remote MCP servers.
- Limit OAuth token scopes issued to MCP clients to reduce the blast radius of a captured token.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
