---
id: CVE-2026-64684
title: RMCP is an official Rust SDK for the Model Context Protocol
summary: >-
  RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0,
  the rmcp crate's StreamableHttpClientTransport in
  crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its
  default_http_client with reqwest…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-200
  - CWE-212
vendor: modelcontextprotocol
product: rust-sdk
affected:
  - rust-sdk < 2.1.0
patched:
  - rmcp 2.1.0
published: '2026-09-16'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64684'
references:
  - url: >-
      https://github.com/modelcontextprotocol/rust-sdk/commit/496902b9cf2c8a947454718da31829ae776b969b
    label: security-advisories@github.com
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/pull/936'
    label: security-advisories@github.com
  - url: 'https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64684'
  - url: 'https://github.com/modelcontextprotocol/rust-sdk'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64684.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64684'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2535732'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64684'
  - url: 'https://github.com/advisories/GHSA-9g45-5xwm-f3wc'
tags:
  - nvd
  - cve.org
  - osv
  - rust
  - csaf
  - vex
  - red-hat
  - ghsa
epss: 0.00395
epssPercentile: 0.33527
aliases:
  - GHSA-9g45-5xwm-f3wc
ecosystem: rust
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-19T01:56:38.766580Z'
ingestedAt: '2026-09-16T22:06:50.936Z'
---

## Overview

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-64684)

Affected packages:

- `rmcp < 2.1.0`

Patched in:

- `rmcp 2.1.0`

Source: https://osv.dev/vulnerability/GHSA-9g45-5xwm-f3wc

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64684.json)