Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-27 · source-backed
PR #29081, merged August 26 and in nightly v0.59.0-nightly.20260827, enforces RFC 9728 §7.7 and RFC 8414 constraints across MCP OAuth metadata discovery, dynamic client registration, and token exchange. It requires HTTPS for remote endpoints with HTTP allowed only for loopback, validates origin matching on resource_metadata in WWW-Authenticate challenges, blocks private IPv4/IPv6, link-local, IMDS at [redacted], benchmark 198.18.0.0/15 and multicast ranges, and resolves DNS asynchronously specifically to defeat rebinding (GitHub). A remote MCP server could previously steer the CLI's own OAuth flow at cloud metadata endpoints.
Each link below shares sources, entities, or timing with this story.
MCP uses OAuth / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover August, HTTP, MCP, RFC; overlapping topics (august, client).
MCP uses OAuth / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover August, HTTP, MCP, OAuth; reported by the same outlet (github.com).
MCP uses OAuth / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover August, HTTP, MCP, RFC; reported by the same outlet (github.com).
Linked by a graph relationship (MCP uses OAuth); both cover August, GitHub, HTTPS, MCP; reported by the same outlet (github.com).
Linked by a graph relationship (MCP uses OAuth); both cover August, GitHub, MCP, OAuth; reported by the same outlet (github.com).
MCP uses OAuth / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover August, DNS, GitHub, MCP; overlapping topics (august, client).
MCP uses OAuth / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (MCP uses OAuth); both cover August, CLI, GitHub, MCP; reported by the same outlet (github.com).
MCP uses OAuth / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (MCP uses OAuth); both cover August, GitHub, MCP; reported by the same outlet (github.com).