CVE-2026-64684 Overview
CVE-2026-64684 affects RMCP, the official Rust SDK for the Model Context Protocol (MCP). Versions prior to 2.1.0 leak caller-supplied custom headers, including API keys and authentication tokens, when the StreamableHttpClientTransport follows a cross-origin HTTP 307 or 308 redirect. A malicious or compromised MCP endpoint can capture these credentials and replay them against the legitimate service. The issue is tracked under [CWE-200] Information Exposure and is fixed in RMCP version 2.1.0.
Critical Impact
Custom authentication headers configured through StreamableHttpClientTransportConfig.custom_headers are forwarded to attacker-controlled origins during cross-origin redirects, enabling credential theft and downstream account compromise.
Affected Products
- RMCP crate (rmcp) versions prior to 2.1.0
- Applications using StreamableHttpClientTransport from crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs
- Rust MCP clients configured with custom_headers for API keys or bearer tokens
Discovery Timeline
- 2026-09-16 - CVE-2026-64684 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-64684
Vulnerability Analysis
The RMCP SDK provides StreamableHttpClientTransport for HTTP-based communication with MCP servers. Its default_http_client builds a reqwest client with the default automatic redirect policy enabled. When callers configure authentication material through StreamableHttpClientTransportConfig.custom_headers, the apply_custom_headers function attaches those headers to every outgoing request.
The reqwest HTTP client only strips headers it explicitly recognizes as sensitive on cross-origin redirects. Custom headers such as X-API-Key, X-Auth-Token, or vendor-specific bearer tokens are not marked sensitive and therefore travel with the follow-up request to the redirect target. A malicious MCP endpoint that returns a 307 Temporary Redirect or 308 Permanent Redirect to an attacker-controlled origin receives the caller's credentials verbatim.
The separate auth_header code path is unaffected because it uses the standard Authorization header, which reqwest strips automatically when the destination host changes.
Root Cause
The root cause is the combination of two defaults. First, the reqwest client is constructed with automatic redirect following enabled. Second, headers supplied through custom_headers are inserted into the request without being flagged as sensitive via reqwest's sensitive-header API. This leaves credential-bearing headers eligible for replay on any redirect the server chooses to issue.
Attack Vector
An attacker who controls or compromises an MCP server endpoint returns a 307 or 308 redirect pointing at an attacker-owned host. The RMCP client follows the redirect and reissues the original request, including the caller-supplied custom headers, against the new origin. The attacker records the headers, extracts the API key or token, and replays them against the legitimate upstream service to impersonate the client.
Exploitation requires the victim client to connect to an untrusted or compromised MCP endpoint, which raises attack complexity but does not require user interaction or prior authentication on the attacker side.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-9g45-5xwm-f3wc and the fix commit for the authoritative technical description.
Detection Methods for CVE-2026-64684
Indicators of Compromise
- Outbound HTTPS requests from Rust MCP client hosts to domains that do not match the configured MCP server hostname.
- MCP server responses with status codes 307 or 308 whose Location header points to a different origin than the request URL.
- Authentication or API-key material appearing in access logs of services or hosts that should never have received them.
Detection Strategies
- Inventory Rust projects that depend on the rmcp crate and compare resolved versions against 2.1.0 using cargo tree or SBOM tooling.
- Instrument or proxy MCP client traffic to alert on any cross-origin redirect returned by an MCP endpoint.
- Review application configuration for any use of StreamableHttpClientTransportConfig.custom_headers carrying secrets.
Monitoring Recommendations
- Log the final resolved URL for every MCP request and alert when it differs from the configured base URL host.
- Monitor identity providers and API gateways for authentication attempts using MCP client credentials from unexpected source IPs or user agents.
- Rotate and monitor any API keys previously configured through custom_headers on vulnerable RMCP versions.
How to Mitigate CVE-2026-64684
Immediate Actions Required
- Upgrade the rmcp crate to version 2.1.0 or later and rebuild all affected Rust binaries.
- Rotate all API keys, tokens, and secrets that were transmitted through custom_headers on vulnerable versions.
- Restrict MCP client connections to trusted, first-party MCP server endpoints until upgrades are complete.
Patch Information
The fix is included in RMCP release rmcp-v2.1.0. The remediation, implemented in pull request #936 and merged in commit 496902b, marks caller-supplied custom headers as sensitive so that reqwest strips them on cross-origin redirects, matching the behavior of the standard Authorization header path.
Workarounds
- Configure the underlying reqwest client with redirect::Policy::none() to disable automatic redirect following for MCP transports.
- Move authentication material from custom_headers to the auth_header path, which uses the standard Authorization header and is stripped on cross-origin redirects.
- Constrain MCP client egress at the network layer to only the expected MCP server hostnames, blocking follow-up requests to unexpected origins.
# Update the rmcp dependency to the patched release
cargo update -p rmcp --precise 2.1.0
cargo tree -p rmcp | head -n 5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
