KEVWire

Security intelligence, with context.

Response snapshot Oct 27, 2026, 23:56 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-116685

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host.

Published Updated

At a glance

Exploited
Not known
Severity
5.9 Medium (CVSS 3.1)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: mcp: 2.2.0; mcp: 1.30.0. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-5h93-6whr-6q8j (opens a new tab)

What happened

Summary

In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin:

- custom headers set on the client (for example an X-API-Key credential) were sent to that origin, and - on a 307 or 308 redirect the request body was re-sent there too.

The SDK's OAuth client providers followed redirects on their own discovery, registration and token requests in the same way.

Continue reading

A lone Authorization bearer header was not exposed; the HTTP library already drops it on cross-origin redirects.

Anyone able to make an endpoint you trust redirect elsewhere (a stale redirect to a lapsed domain, a misrouted proxy rule, redirect logic an attacker can influence) could capture that material. A server that is itself malicious gains nothing this way; it already receives your requests directly.

Am I affected?

Yes, if your code uses the SDK as an MCP client over HTTP through any of:

- streamable_http_client (on 2.x also Client given an http:// or https:// URL) - streamablehttp_client or sse_client - ClientSessionGroup with HTTP server parameters - the internal create_mcp_http_client helper

This includes an HTTP client you passed in yourself with follow_redirects=True.

Affected versions: 1.8.0 through 1.29.1, and 2.0.0 through 2.1.1.

Not affected:

- MCP servers - stdio clients - a client you supplied with follow_redirects left at its default of False

Fix

Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later; no code changes are needed.

The transports, and the OAuth providers' own requests, now follow a redirect only when it stays on the endpoint's origin (same scheme, host and port, or an http to https upgrade on the same host) and keeps the request method. Any other redirect is not followed and the request fails with an error naming the target (MCPError on 2.x, httpx.HTTPStatusError on 1.x), whichever HTTP client the transport uses.

The internal create_mcp_http_client helper no longer turns redirect following on, so code calling it directly now receives the redirect response instead.

If your client currently reaches its server through a redirect to another host, including a server that needs no credentials, it will stop connecting after the upgrade: set the endpoint URL to the redirect's target.

Until you can upgrade, supply your own HTTP client with follow_redirects left at False (http_client= on streamable_http_client; httpx_client_factory= on sse_client and streamablehttp_client; ClientSessionGroup has no such parameter). If a client may already have followed a redirect to a host you do not control, rotate the credentials it carried.

If you genuinely need the old behaviour (unsupported)

This restores what this advisory fixes: redirects to any host are followed again, carrying your custom headers and, on 307/308, the request body, OAuth token requests included. Prefer setting the endpoint URL to the redirect's target. If you cannot, and you accept forwarding credentials to the redirect target, give the transport an HTTP client that follows redirects regardless of what the SDK asks for:

import httpx2 # on 1.x: import httpx and subclass httpx.AsyncClient instead

class FollowRedirectsAnyway(httpx2.AsyncClient):
 """Follows redirects to ANY origin. Deliberately gives up the SDK's same-origin protection."""

 async def send(self, request, *, follow_redirects=False, **kwargs):
 return await super().send(request, follow_redirects=True, **kwargs)

http_client = FollowRedirectsAnyway(timeout=httpx2.Timeout(30, read=300))
# streamable_http_client(url, http_client=http_client)

# sse_client / streamablehttp_client take a factory instead:
def client_factory(headers=None, timeout=None, auth=None):
 return FollowRedirectsAnyway(headers=headers, auth=auth,
 timeout=timeout if timeout is not None else httpx2.Timeout(30, read=300))
# sse_client(url, httpx_client_factory=client_factory)

The redirect handling is then the HTTP library's own, as before the fix: a lone Authorization header is still dropped on cross-origin hops and 301/302/303 become GET. It is not something the SDK supports or tests.

---

Affected package ranges reported by GitHub: mcp: >= 2.0.0, < 2.2.0 mcp: >= 1.8.0, < 1.30.0

Scores and how they were measured

CVSS base severity

5.9

Version 3.1As of

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-5h93-6whr-6q8j (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-5h93-6whr-6q8j, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 27). Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVE-2026-116685). https://kevwire.com/record/CVE-2026-116685

MLA

"Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVE-2026-116685)." KEVWire, 27 Oct. 2026, kevwire.com/record/CVE-2026-116685.

Chicago

KEVWire. "Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVE-2026-116685)." Last modified October 27, 2026. https://kevwire.com/record/CVE-2026-116685.

Evidence summary (plain text)

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (Oct 27, 2026).
In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin:

- custom headers set on the client (for example an X-API-Key credential) were sent to that origin, and
- on a 307 or 308 redirect the request body was re-sent there too.

The SDK's OAuth client providers followed redirects on their own discovery, registration and token requests in the same way.
CVSS 5.9 (version 3.1; evidence as of Oct 27, 2026; https://github.com/advisories/GHSA-5h93-6whr-6q8j).
Sources:
GitHub-reviewed advisory GHSA-5h93-6whr-6q8j: https://github.com/advisories/GHSA-5h93-6whr-6q8j
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-116685.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 27, 2026, 23:40 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are not available yet. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail