CVE-2026-116685: CVE-2026-116685: Cross-Origin Redirect Credential and Request Payload Disclosure in MCP Python SDK

A sensitive information disclosure vulnerability, CVE-2026-116685 (CVSS 5.9), was disclosed in the official Model Context Protocol Python SDK, affecting versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. The SDK's Streamable HTTP, SSE, and OAuth client transports unconditionally followed cross-origin redirects, forwarding custom authentication headers such as X-API-Key and, on HTTP 307/308 responses, replaying full POST bodies with JSON-RPC or OAuth payloads to untrusted hosts. Versions 1.30.0 and 2.2.0 restrict redirect traversal to the original endpoint origin, and users who cannot upgrade immediately are advised to set follow_redirects=False on custom httpx clients.

Vulnerability ID: CVE-2026-116685 CVSS Score: 5.9 Published: 2026-10-27 CVE-2026-116685 GHSA-5h93-6whr-6q8j is a sensitive information disclosure vulnerability in the official Model Context Protocol MCP Python SDK mcp on PyPI . In versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, the SDK's HTTP-based client transports—including Streamable HTTP, Server-Sent Events SSE , and OAuth client flows—unconditionally enable automatic HTTP redirect following follow redirects=True across origin boundaries. When a configured endpoint returns a redirect to an external origin, the HTTP client forwards caller-supplied custom authentication headers such as X-API-Key and, in the case of HTTP 307 or 308 responses, replays the full POST request body containing JSON-RPC payloads or OAuth parameters to the untrusted destination. The Model Context Protocol MCP Python SDK mcp versions 1.8.0–1.29.1 and 2.0.0–2.1.1 unconditionally follows cross-origin HTTP redirects in its Streamable HTTP, SSE, and OAuth client transports. If a trusted MCP server or intermediate proxy redirects a client to an external domain, custom credential headers e.g., X-API-Key and HTTP 307/308 POST request bodies are transmitted to the external host. Users should upgrade to version 1.30.0 or 2.2.0, which restrict redirect traversal strictly to the original endpoint origin. mcp PyPI package 1.30.0 2.2.0 Restrict HTTP client redirects to the endpoint origin 3397 - v2.x remediation Restrict HTTP client redirects to the endpoint origin v1.x 3448 - v1.x backport Allow same-origin redirects when original URL has userinfo 3450 follow redirects=False on custom httpx.AsyncClient instances or httpx client factory callables passed to MCP client transports if immediate upgrading is blocked. X-Forwarded-Proto headers and use canonical endpoint URLs so legitimate requests do not trigger cross-scheme redirects. X-API-Key or proprietary authentication tokens used by MCP clients that communicated with endpoints susceptible to open redirects or third-party domain redirects. Remediation Steps: pip show mcp or inspect requirements.txt , pyproject.toml , uv.lock , or poetry.lock . pip install --upgrade "mcp =1.30.0,<2.0.0" . pip install --upgrade "mcp =2.2.0" . Read the full report for CVE-2026-116685 on our website https://cvereports.com/reports/CVE-2026-116685 for more details including interactive diagrams and full exploit analysis.