AIKIDO-2026-617985

rmcp is vulnerable to Improper Authorization

Pre-CVE Published Aug 3, 2026

CVE Score

Medium

Improper Authorization

TL;DR

The rmcp protocol handling accepts restricted server-to-client requests (such as sampling/createMessage, roots/list, and elicitation/create) without confirming they are associated with the originating request context or inbound stream. A malicious or compromised MCP server can issue restricted requests that the client processes as if they were legitimately associated, enabling confused-deputy invocation of client-side capabilities. Before the fix these unassociated requests were dispatched to the client handler instead of rejected. The fix (SEP-2260) enforces receive-side request association and rejects unassociated restricted requests with an invalid-params (-32602) error.

How do I fix this?

Upgrade the rmcp library to the patch version.

Who does this affect?

You are affected if you are on a version within the vulnerable range, your application uses the rmcp client to connect to untrusted or externally controlled MCP servers, and you have implemented the client-side handlers for restricted server-to-client requests (sampling/createMessage, roots/list, or elicitation/create). Clients that leave these handlers at their safe defaults (which decline or return method-not-found) have limited exposure.