Answer in brief
CVE-2026-64684 records a Medium severity (CVSS 6.8) vulnerability in RMCP: Custom HTTP headers leak to cross-origin redirect targets. The current sources do not mark it as known exploited. The current feed maps rmcp (crates.io), modelcontextprotocol/rust-sdk (generic), rmcp (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps rmcp (crates.io), modelcontextprotocol/rust-sdk (generic), rmcp (rust). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| rmcpcrates.io | >=0 <2.1.0 | 2.1.0 |
| modelcontextprotocol/rust-sdkgeneric | <2.1.0 | 2.1.0 |
| rmcprust | <2.1.0 | 2.1.0 |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.
Quoted source text, attributed separately from HOL analysis.