{"id":"EUVD-2026-81266","enisaUuid":"93285580-2302-3dc6-a825-85c77c273680","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate\u0027s StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest\u0027s automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.","datePublished":"Sep 16, 2026, 9:18:48 PM","dateUpdated":"Sep 19, 2026, 1:56:51 AM","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/936\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/496902b9cf2c8a947454718da31829ae776b969b\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0\n","aliases":"CVE-2026-64684\nGHSA-9g45-5xwm-f3wc\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"6aabade9-989f-30e2-a3d4-194eceacc322","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 2.1.0"}],"enisaIdVendor":[{"id":"cfc68caa-0cea-34bb-842f-a25a86f849ce","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"0df7f05c-b0d7-317a-abda-9e8c526100ad","vulnerability":{"id":"GHSA-9g45-5xwm-f3wc","description":"RMCP: Custom HTTP headers leak to cross-origin redirect targets","datePublished":"Sep 17, 2026, 2:48:12 PM","dateUpdated":"Sep 17, 2026, 4:36:36 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64684\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/936\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/496902b9cf2c8a947454718da31829ae776b969b\nhttps://github.com/modelcontextprotocol/rust-sdk\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0\n","enisa_id":"EUVD-2026-81266\n","aliases":"GHSA-9g45-5xwm-f3wc\nCVE-2026-64684\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:48 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d0b9634e-725d-32e7-827c-abeb6dc31a4f","vulnerability":{"id":"CVE-2026-64684","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate\u0027s StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest\u0027s automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.","datePublished":"Sep 16, 2026, 9:18:48 PM","dateUpdated":"Sep 19, 2026, 1:56:51 AM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/936\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/496902b9cf2c8a947454718da31829ae776b969b\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0\n","enisa_id":"EUVD-2026-81266\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Nov 9, 2026, 3:07:33 PM","vulnerabilityProduct":[{"id":"7ebf862f-c3fd-3833-826d-1ca17ce64d84","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 2.1.0"}],"vulnerabilityVendor":[{"id":"7aab17e4-8bdb-3b92-911c-9f67847e321a","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[{"id":"1e4dd8de-9edc-3023-98c2-4c4847addb90","advisory":{"id":"openSUSE-SU-2026:11849-1","description":"openai-codex-0.155.1-1.1 on GA media","summary":"openai-codex-0.155.1-1.1 on GA media","datePublished":"Sep 22, 2026, 12:00:00 AM","dateUpdated":"Sep 23, 2026, 8:33:17 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11849-1.json\nhttps://www.suse.com/security/cve/CVE-2026-63127/\nhttps://www.suse.com/security/cve/CVE-2026-63128/\nhttps://www.suse.com/security/cve/CVE-2026-64684/\n","aliases":"CVE-2026-63127\nCVE-2026-63128\nCVE-2026-64684\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1415397c-3ec8-3ead-b743-b263bcfd79bd","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2153049d-f1a0-3e14-b77f-19f0d282da95","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"279da4ec-5231-3256-92f5-8cbb5a0f8a66","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"46b83533-23cf-3f77-ad5a-91b1f1b10e8f","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"688e9e22-00ae-3a45-b9ee-c126a11ba447","product":{"name":"openai-codex-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7d625da1-e60f-3d2c-94e1-2458d85d7230","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7f4449dc-de12-3a4e-bec2-e1e16db99632","product":{"name":"openai-codex-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7f8a561d-3059-3f80-a08f-73f1bfcec069","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"810903c8-2fac-34a3-8091-211d5edd6adb","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a4088ab2-8b4f-3c05-be5a-fa39c82730b9","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bfa2be11-009d-3fec-94d7-d46e8fee588d","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"bfed0193-7bdf-370b-9154-0a2e0f4ea24d","product":{"name":"openai-codex-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c4bde4ca-c403-3d25-a644-0c510274d9d2","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"c5348a95-c3fc-361d-9b0a-c1cfe8063e2b","product":{"name":"openai-codex-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e3df8ad1-3aa4-3e15-b1d0-67f93efe0a08","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f4a38003-f788-367b-8af1-760ec312d727","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f764675f-69c8-3752-bffd-2cf68ca5d5d3","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}}]}