AIKIDO-2026-322535

TL;DR

The rmcp Streamable HTTP client transport builds its default HTTP client without disabling automatic redirect following. Caller-supplied custom headers, including secret authentication headers such as X-API-Key, are not marked sensitive, so they are forwarded to cross-origin redirect targets while only standard credential headers are stripped. A compromised or malicious MCP server that returns a cross-origin redirect can capture these credentials from the victim client. The fix disables automatic redirect following so custom headers are no longer leaked to redirect destinations.