CVE-2026-64684: RMCP: Custom HTTP headers leak to cross-origin redirect targets
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.customheaders without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and applycustomheaders causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate authheader path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rmcpto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
Which deployments are exposed to credential leakage?
Deployments using rmcp before 2.1.0 are exposed if they configure StreamableHttpClientTransportConfig.custom_headers with API keys, authentication tokens, or other sensitive values and connect to an endpoint that can return a cross-origin 307 or 308 redirect. The separate auth_header mechanism is not affected.
What does an attacker need to exploit this issue?
An attacker needs a malicious or compromised MCP endpoint to issue a cross-origin 307 or 308 redirect. The client must have sensitive caller-supplied custom headers configured, because those headers are replayed to the redirect target.
What should teams do if they cannot immediately upgrade?
Avoid placing credentials or other secrets in custom_headers, and use the separate auth_header path where applicable. Do not connect affected clients to untrusted or potentially compromised MCP endpoints that could issue redirects.
How can we determine whether our integration is affected?
Review whether the rmcp version is earlier than 2.1.0 and whether StreamableHttpClientTransportConfig.custom_headers contains sensitive values. Also review whether configured MCP endpoints can issue or have issued cross-origin 307 or 308 redirects.