Vulnerability ID: CVE-2026-116685 CVSS Score: 5.9
Published: 2026-10-27
CVE-2026-116685 (GHSA-5h93-6whr-6q8j) is a sensitive information disclosure vulnerability in the official Model Context Protocol (MCP) Python SDK (mcp on PyPI). In versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, the SDK's HTTP-based client transports—including Streamable HTTP, Server-Sent Events (SSE), and OAuth client flows—unconditionally enable automatic HTTP redirect following (follow_redirects=True) across origin boundaries. When a configured endpoint returns a redirect to an external origin, the HTTP client forwards caller-supplied custom authentication headers (such as X-API-Key) and, in the case of HTTP 307 or 308 responses, replays the full POST request body containing JSON-RPC payloads or OAuth parameters to the untrusted destination.
The Model Context Protocol (MCP) Python SDK (mcp versions 1.8.0–1.29.1 and 2.0.0–2.1.1) unconditionally follows cross-origin HTTP redirects in its Streamable HTTP, SSE, and OAuth client transports. If a trusted MCP server or intermediate proxy redirects a client to an external domain, custom credential headers (e.g., X-API-Key) and HTTP 307/308 POST request bodies are transmitted to the external host. Users should upgrade to version 1.30.0 or 2.2.0, which restrict redirect traversal strictly to the original endpoint origin.
mcp PyPI package)1.30.0) 2.2.0)
Restrict HTTP client redirects to the endpoint origin (#3397) - v2.x remediation
Restrict HTTP client redirects to the endpoint origin (v1.x) (#3448) - v1.x backport Allow same-origin redirects when original URL has userinfo (#3450)
follow_redirects=False) on custom httpx.AsyncClient instances or httpx_client_factory callables passed to MCP client transports if immediate upgrading is blocked.X-Forwarded-Proto headers and use canonical endpoint URLs so legitimate requests do not trigger cross-scheme redirects.X-API-Key) or proprietary authentication tokens used by MCP clients that communicated with endpoints susceptible to open redirects or third-party domain redirects.
Remediation Steps:
pip show mcp or inspect requirements.txt, pyproject.toml, uv.lock, or poetry.lock). pip install --upgrade "mcp>=1.30.0,<2.0.0". pip install --upgrade "mcp>=2.2.0".
Read the full report for CVE-2026-116685 on our website for more details including interactive diagrams and full exploit analysis.