CARGO · SEPTEMBER 2026 · EARLY WARNING

RMCP Library Vulnerability Requires Immediate Attention

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
rmcp (cargo)
Affected versions
< 2.0.0 or < 1.4.0 or < 2.0.0 or >= 0.0.0-0, < 1.4.0
Patched version
Not yet available
GHSA-33F5-2C5Q-WGWJ

An early warning has been issued regarding a high-severity vulnerability in the RMCP library. The issue, which is under investigation, could allow malicious servers to redirect OAuth flows and steal access tokens.

What happened

The RMCP library reportedly does not validate the 'resource' parameter in OAuth Protected Resource metadata. This lack of validation appears to enable a malicious server to manipulate OAuth flows, potentially leading to the theft of access tokens. The vulnerability has been tracked under the ID GHSA-33F5-2C5Q-WGWJ and was first flagged on 2026-09-16.

Affected versions of the RMCP library include those less than 2.0.0 or 1.4.0, as well as versions greater than or equal to 0.0.0-0 but less than 1.4.0. It is crucial for users of these versions to assess their exposure and take appropriate action.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If rmcp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using the RMCP library in versions less than 2.0.0 or 1.4.0, or versions greater than or equal to 0.0.0-0 but less than 1.4.0.

What should I do right now?

Review your usage of the RMCP library, update it to include the required resource field validation, and monitor the primary sources for updates.

Has this vulnerability been exploited in the wild?

There is no confirmed report of this vulnerability being exploited in the wild at this time.

Are there any official patches available?

No official patch has been published yet. Monitor the primary sources for updates on any available fixes.

Sources

Join the 0Day waitlist →

← Back to all threats