rmcp replays your X-API-Key to whatever a cross-origin 307 points at

NVD·medium signalXBlueskyLinkedInCopy link

CVE-2026-64684 (6.8 MEDIUM, published 2026-09-16) covers rmcp's `StreamableHttpClientTransport` building its default client without a redirect policy override, so reqwest's default `limited(10)` policy follows 307 and 308 redirects. Caller-supplied `custom_headers` such as `X-API-Key`, `X-Auth-Token` and `Api-Key` are never marked sensitive, so unlike `Authorization`, `Cookie` and `Proxy-Authorization` they are forwarded verbatim to the redirect target. Affects rmcp <= 1.7.0, patched in 2.1.0. If you pass API keys as custom headers to any MCP endpoint you do not control, assume they have been offered to every redirect that endpoint chose.