Threats affecting pkg:cargo/rmcp

The rmcp OAuth client in the modelcontextprotocol rust-sdk accepts a server-controlled resource_metadata URL from the WWW-Authenticate header and fetches it without validating origin or blocking internal network addresses. This allows an attacker-controlled or compromised MCP server to induce the client to make HTTP requests to internal or cloud metadata endpoints, potentially exposing sensitive internal resources. The vulnerability is classified as SSRF with medium severity, depending on the network context of the embedding application. A patch is available to enforce same-origin checks and block private network addresses.

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.