Executive brief
The rmcp crate in the Model Context Protocol Rust SDK forwards custom HTTP headers (such as API keys and authentication tokens) to servers reached via cross-origin redirects. If an attacker compromises the primary server and redirects traffic to an attacker-controlled site, sensitive headers are leaked, allowing the attacker to capture API keys and impersonate the legitimate client.
Technical details
The vulnerability exists in StreamableHttpClientTransport, which uses reqwest's default redirect policy (limited to 10 redirects) without override. The default policy follows 307/308 redirects and strips only Authorization, Cookie, and Proxy-Authorization headers on cross-origin redirects; custom headers injected via StreamableHttpClientTransportConfig.custom_headers are not marked as sensitive and are forwarded verbatim. The root cause is twofold: (1) default_http_client() does not call .redirect(Policy::none()) to disable automatic following, and (2) custom headers are added via RequestBuilder::header() without sensitivity marking. An attacker who can compromise the primary MCP server can issue a 307/308 redirect to an attacker-controlled site and capture forwarded API keys or other auth headers. The fix is to disable automatic redirect following in default_http_client() and inspect 3xx responses before forwarding requests.
Affected products
- Model Context Protocol Rust SDK c330fede90e4729c234f8e87fdbc5ea27a1dd10c and earlier
Timeline
- 2026-09-17: disclosed