CVE-2026-64684: RMCP: Custom HTTP headers leak to cross-origin redirect targets

Published Sep 16, 2026
·
Updated

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.customheaders without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and applycustomheaders causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate authheader path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.

Affected Software

1 affected component
RMCP rmcp<2.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rmcp to a version that resolves this vulnerability.

    Fixed in 2.1.0

Event History

Sep 16, 2026
CVE Published
via MITRE·09:18 PM
Data Sourced
via MITRE·09:18 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed to credential leakage?

Deployments using rmcp before 2.1.0 are exposed if they configure StreamableHttpClientTransportConfig.custom_headers with API keys, authentication tokens, or other sensitive values and connect to an endpoint that can return a cross-origin 307 or 308 redirect. The separate auth_header mechanism is not affected.

2

What does an attacker need to exploit this issue?

An attacker needs a malicious or compromised MCP endpoint to issue a cross-origin 307 or 308 redirect. The client must have sensitive caller-supplied custom headers configured, because those headers are replayed to the redirect target.

3

What should teams do if they cannot immediately upgrade?

Avoid placing credentials or other secrets in custom_headers, and use the separate auth_header path where applicable. Do not connect affected clients to untrusted or potentially compromised MCP endpoints that could issue redirects.

4

How can we determine whether our integration is affected?

Review whether the rmcp version is earlier than 2.1.0 and whether StreamableHttpClientTransportConfig.custom_headers contains sensitive values. Also review whether configured MCP endpoints can issue or have issued cross-origin 307 or 308 redirects.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203