RMCP Streamable HTTP Client Credential Leak via Cross-Origin Redirect

Technical Analysis

StreamableHttpClientTransport builds its default_http_client with reqwest's default automatic redirect-following enabled, and apply_custom_headers injects StreamableHttpClientTransportConfig.custom_headers on every request without marking them as origin-sensitive or stripping them on cross-origin hops. When an attacker-controlled or compromised MCP server responds with a 307 or 308 redirect to an attacker-owned origin, reqwest transparently follows it and reattaches the custom headers, exposing API keys or bearer tokens to the redirect target. This crosses a trust boundary because the MCP client believes it is only communicating with the intended server, but credentials configured for that server leak to an arbitrary third party chosen by the server response. The standard `Authorization` header is unaffected since reqwest strips it by default on cross-origin redirects, making this specific to custom-header-based auth schemes commonly used for API keys.

Affected Systems

rmcp (Rust MCP SDK); protocols: MCP

Detection Signatures

• HTTP 307/308 responses from MCP server endpoints followed by outbound requests to a different origin retaining custom Authorization-like headers
• Outbound traffic from MCP client to unexpected/unlisted domains immediately following a redirect response from a configured MCP server
• Custom header values (e.g., X-API-Key, api-key, token) observed in request logs to non-allowlisted hosts
• Use of rmcp crate versions <2.1.0 with StreamableHttpClientTransportConfig.custom_headers configured

Remediation Steps

1. 1

   Upgrade rmcp

   Update the rmcp crate to version 2.1.0 or later, which fixes the header replay behavior on cross-origin redirects.

2. 2

   Disable or restrict automatic redirects

   Configure the underlying reqwest client to disable automatic redirect following, or implement a custom redirect policy that strips sensitive custom headers when the origin changes.

3. 3

   Prefer Authorization header for secrets

   Where possible, use the standard Authorization header (auth_header path) instead of custom headers for credentials, since reqwest already strips it cross-origin by default.

4. 4

   Pin and vet MCP server endpoints

   Only connect to trusted, allowlisted MCP server origins and monitor for unexpected redirect responses in client logs.

5. 5

   Rotate exposed credentials

   If any client using an affected rmcp version connected to an untrusted or compromised MCP server, rotate all API keys/tokens configured via custom_headers.