The rmcp crate's StreamableHttpClientTransport in versions before 2.1.0 builds its default HTTP client with reqwest's automatic redirect policy and applies caller-supplied custom headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and the custom headers (including API keys or tokens) are replayed to the new origin. This can lead to exposure of sensitive information to unauthorized actors. The standard Authorization header path is not affected because reqwest strips it on cross-origin redirects. The vulnerability is resolved in version 2.1.0.

An attacker controlling or compromising an MCP endpoint can exploit this vulnerability by returning a cross-origin 307 or 308 redirect, causing the client to resend sensitive custom headers such as API keys or authentication tokens to an unintended origin. This leads to exposure of sensitive information, which an attacker can capture and reuse, potentially compromising the security of the affected system. The vulnerability does not affect the standard Authorization header, limiting the scope to custom headers.

Upgrade to modelcontextprotocol rust-sdk version 2.1.0 or later, where this issue is fixed. The fix involves marking custom headers as sensitive to prevent them from being replayed on cross-origin redirects. No other mitigation is required as the vulnerability is addressed by this official fix.