A third rmcp advisory in three days, and this one leaks your API key to whatever a redirect points at.

GHSA-9g45-5xwm-f3wc, published September 17, follows the two rmcp advisories from September 16 covering OAuth token theft and a permanent session-table leak. This one is client-side: custom headers set on the MCP client, which in practice carry API keys and bearer tokens, get re-sent to whatever host a cross-origin redirect names. Running the official Rust MCP SDK against a third-party server means treating every redirect as a credential exfiltration channel. Separately, GHSA-hx8v-g79f-8w5f covers SSRF in LiteLLM Proxy through the user_config request parameter. LiteLLM usually has network reach into internal services and cloud metadata endpoints the agent itself does not, so the medium rating understates it depending on where you deployed.