rmcp Crate Vulnerability: Custom HTTP Headers Leakage
- Severity
- HIGH
- Affected component
- rmcp (cargo)
- Affected versions
- < 2.0.0 or < 1.4.0 or < 2.1.0 or < 2.0.0 or >= 0.0.0-0, < 1.4.0
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the rmcp crate that may result in the leakage of custom HTTP headers to cross-origin redirect targets. Users of affected versions should review their configurations.
What happened
The rmcp crate, when handling HTTP requests, forwards custom headers to cross-origin redirect targets. This behavior, under the default limited(10) policy, may inadvertently expose sensitive information. The policy allows up to 10 redirects and strips only Authorization, Cookie, and Proxy-Authorization headers on cross-origin redirects.
This vulnerability is under investigation and has not been exploited in the wild as of the latest reports. The issue was first flagged on 2026-09-17T14:48:12+00:00. Users are advised to assess their exposure by reviewing the usage of rmcp in their projects.
What to do about it
- Review the usage of rmcp in your projects to identify any instances where custom HTTP headers might be forwarded to untrusted redirect targets.
- Update your rmcp crate to a version that is not affected if one is available. Currently, no official fix has been published yet.
- Monitor the primary sources for updates on this vulnerability and any released patches.
- Consider implementing additional checks or configurations to prevent the forwarding of sensitive headers to untrusted targets until a fix is available.
How 0Day would have caught this
rmcp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using rmcp crate versions < 2.0.0, < 1.4.0, < 2.1.0, or >= 0.0.0-0, < 1.4.0.
What should I do right now?
Review and update the usage of rmcp to ensure sensitive headers are not forwarded to untrusted redirect targets. Monitor the primary sources for updates on this vulnerability.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for updates.