The OAuth handshake found a confused deputy

CVE-2026-63127 hits rmcp, the Rust model-context-protocol SDK, upstream in its metadata handler. When an MCP server presents its OAuth metadata, the SDK does not enforce the mandatory RFC 8707 resource indicator that tells the authorization server exactly which resource the token is scoped to.

A rogue or compromised MCP server can simply omit the indicator and receive a broad enterprise OAuth token from the client agent — one written for the wider workspace rather than the single tool. The agent then hands that token to the things it connects to, and the scope it meant to limit turns out to be the scope it actually got. CVSS 3.1 base 8.5. The fix landed in rmcp 0.8.4 or later.

The pattern is the one the field keeps rediscovering in agent infrastructure: an intermediary holds more authority than it should, and a trust boundary is decided by whatever the remote party chooses to say rather than the client's own request. Here the deputy is the agent itself, which holds an enterprise token and passes it along; the confused part is that the server gets to decide how broad that token is.

It slots neatly alongside the sibling MCP vulnerabilities the log has been tracking — the traversal-to-PAT flows and the container-to-host lateral movement — all of which share the same root: the contract between agent and tool assumes the tool will behave.

The log's running concern has been that agent ecosystems concentrate authority in protocols that assume good behavior. This is the same confused-deputy shape, showing up in the OAuth handshake where it is easiest to overlook because the failure is silent. A patched SDK and an 8.5 CVSS is the fix, but the distribution problem remains — how many deployed servers are still running below 0.8.4, and how many clients would notice a subtle scope widening at all.