{"id":"CVE-2026-64684","summary":"RMCP: Custom HTTP headers leak to cross-origin redirect targets","details":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.","aliases":["GHSA-9g45-5xwm-f3wc"],"modified":"2026-09-18T03:48:29.097721729Z","published":"2026-09-16T21:18:48.886Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64684.json"},"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64684.json"},{"type":"ADVISORY","url":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64684"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/rust-sdk/commit/496902b9cf2c8a947454718da31829ae776b969b"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/rust-sdk/pull/936"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/modelcontextprotocol/rust-sdk","events":[{"introduced":"0"},{"fixed":"496902b9cf2c8a947454718da31829ae776b969b"},{"fixed":"8e44af499bfa8d54f18fb475eb86a601a5a2e432"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"2.1.0"}]}}],"versions":["rmcp-v1.8.0","rmcp-macros-v1.8.0","rmcp-v2.0.0","rmcp-macros-v2.0.0","rmcp-v1.7.0","rmcp-macros-v1.7.0","rmcp-v1.6.0","rmcp-macros-v1.6.0","rmcp-v1.5.0","rmcp-macros-v1.5.0","rmcp-v1.4.0","rmcp-macros-v1.4.0","rmcp-v1.3.0","rmcp-macros-v1.3.0","rmcp-v1.2.0","rmcp-macros-v1.2.0","rmcp-v1.1.1","rmcp-macros-v1.1.1","rmcp-v1.1.0","rmcp-macros-v1.1.0","rmcp-v1.0.0","rmcp-macros-v1.0.0","rmcp-v1.0.0-alpha","rmcp-macros-v1.0.0-alpha","rmcp-v0.17.0","rmcp-macros-v0.17.0","rmcp-v0.16.0","rmcp-macros-v0.16.0","rmcp-v0.15.0","rmcp-macros-v0.15.0","rmcp-v0.14.0","rmcp-macros-v0.14.0","rmcp-v0.13.0","rmcp-macros-v0.13.0","rmcp-v0.12.0","rmcp-macros-v0.12.0","rmcp-v0.11.0","rmcp-macros-v0.11.0","rmcp-v0.10.0","rmcp-macros-v0.10.0","rmcp-v0.9.1","rmcp-macros-v0.9.1","rmcp-v0.9.0","rmcp-macros-v0.9.0","rmcp-v0.8.5","rmcp-macros-v0.8.5","rmcp-v0.8.4","rmcp-macros-v0.8.4","rmcp-v0.8.3","rmcp-macros-v0.8.3","rmcp-v0.8.2","rmcp-macros-v0.8.2","rmcp-v0.8.1","rmcp-macros-v0.8.1","rmcp-v0.8.0","rmcp-macros-v0.8.0","rmcp-v0.7.0","rmcp-macros-v0.7.0","rmcp-v0.6.3","rmcp-macros-v0.6.3","rmcp-v0.6.2","rmcp-macros-v0.6.2","rmcp-v0.6.1","rmcp-macros-v0.6.1","rmcp-v0.6.0","rmcp-macros-v0.6.0","rmcp-v0.5.0","rmcp-macros-v0.5.0","rmcp-v0.4.1","rmcp-macros-v0.4.1","rmcp-v0.4.0","rmcp-macros-v0.4.0","rmcp-v0.3.2","rmcp-macros-v0.3.2","rmcp-v0.3.1","rmcp-macros-v0.3.1","rmcp-v0.3.0","rmcp-macros-v0.3.0","rmcp-v0.2.1","rmcp-macros-v0.2.1","rmcp-v0.2.0","rmcp-macros-v0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64684.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}]}