EUVD-2026-81266Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
AC:H because the attacker must control the trusted endpoint and the victim must configure secret custom_headers; S:C and C:H because credentials leak to a different origin; no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies caller-supplied values from StreamableHttpClientTransportConfig.custom_headers without marking them as sensitive. When a malicious or compromised MCP endpoint returns a cross-origin 307 or 308 redirect, reqwest follows the redirect and apply_custom_headers causes custom API keys or authentication tokens to be replayed to the new origin, where an attacker can capture and reuse them. The separate auth_header path is not affected because it uses the standard Authorization header, which reqwest strips on cross-origin redirects. This issue is fixed in version 2.1.0.
AnalysisAI
Credential leakage in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) prior to 2.1.0 allows an attacker who controls or compromises an MCP endpoint to harvest API keys and tokens from victim clients. StreamableHttpClientTransport builds its default reqwest HTTP client with automatic redirect following and replays caller-supplied StreamableHttpClientTransportConfig.custom_headers on cross-origin 307/308 redirects without marking them sensitive, so secrets such as x-api-key headers are forwarded to the redirect target where the attacker can capture and reuse them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) the victim application uses rmcp's StreamableHttpClientTransport (crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs) at a version prior to 2.1.0; (2) it supplies sensitive credentials via StreamableHttpClientTransportConfig.custom_headers (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are consistent and point to a MEDIUM, condition-gated confidentiality issue rather than an urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the rmcp crate to 2.1.0 or later, which sets reqwest::redirect::Policy::none() on the default HTTP client so caller-supplied custom headers can no longer be replayed to a redirect target (release: https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.1.0; advisory: https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9g45-5xwm-f3wc; fix commit 496902b9cf2c8a947454718da31829ae776b969b via PR #936). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. Rated medium severity (C
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. Rated med
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today