# CVE-2026-116685: CVE-2026-116685: Cross-Origin Redirect Credential and Request Payload Disclosure in MCP Python SDK

> Source: <https://dev.to/cverports/cve-2026-116685-cve-2026-116685-cross-origin-redirect-credential-and-request-payload-disclosure-3pe0>
> Published: 2026-10-28 05:30:50+00:00

**Vulnerability ID:** CVE-2026-116685

**CVSS Score:** 5.9

**Published:** 2026-10-27

CVE-2026-116685 (GHSA-5h93-6whr-6q8j) is a sensitive information disclosure vulnerability in the official Model Context Protocol (MCP) Python SDK (`mcp` on PyPI). In versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, the SDK's HTTP-based client transports—including Streamable HTTP, Server-Sent Events (SSE), and OAuth client flows—unconditionally enable automatic HTTP redirect following (`follow_redirects=True`) across origin boundaries. When a configured endpoint returns a redirect to an external origin, the HTTP client forwards caller-supplied custom authentication headers (such as `X-API-Key`) and, in the case of HTTP 307 or 308 responses, replays the full POST request body containing JSON-RPC payloads or OAuth parameters to the untrusted destination.

The Model Context Protocol (MCP) Python SDK (`mcp` versions 1.8.0–1.29.1 and 2.0.0–2.1.1) unconditionally follows cross-origin HTTP redirects in its Streamable HTTP, SSE, and OAuth client transports. If a trusted MCP server or intermediate proxy redirects a client to an external domain, custom credential headers (e.g., `X-API-Key`) and HTTP 307/308 POST request bodies are transmitted to the external host. Users should upgrade to version 1.30.0 or 2.2.0, which restrict redirect traversal strictly to the original endpoint origin.

`mcp` PyPI package)`1.30.0`)` 2.2.0`)
Restrict HTTP client redirects to the endpoint origin (#3397) - v2.x remediation

Restrict HTTP client redirects to the endpoint origin (v1.x) (#3448) - v1.x backport

Allow same-origin redirects when original URL has userinfo (#3450)

`follow_redirects=False`) on custom `httpx.AsyncClient` instances or `httpx_client_factory` callables passed to MCP client transports if immediate upgrading is blocked.`X-Forwarded-Proto` headers and use canonical endpoint URLs so legitimate requests do not trigger cross-scheme redirects.`X-API-Key`) or proprietary authentication tokens used by MCP clients that communicated with endpoints susceptible to open redirects or third-party domain redirects.
**Remediation Steps:**

`pip show mcp` or inspect `requirements.txt`, `pyproject.toml`, `uv.lock`, or `poetry.lock`).` pip install --upgrade "mcp>=1.30.0,<2.0.0"`.` pip install --upgrade "mcp>=2.2.0"`.
[Read the full report for CVE-2026-116685 on our website](https://cvereports.com/reports/CVE-2026-116685) for more details including interactive diagrams and full exploit analysis.