CVE-2026-116685: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using the affected MCP Python SDK client paths are exposed when they follow a redirect from a trusted endpoint to a different origin and supply custom credential headers. The affected paths are streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client.
What must an attacker control to exploit this issue?
An attacker must be able to influence the redirect destination of an endpoint the client trusts. The client must then follow a cross-origin redirect while carrying caller-supplied custom credential headers; with HTTP 307 or 308 redirects, the request body is forwarded as well.
Are default client settings affected?
The affected client paths enable redirect following. Exposure still depends on a cross-origin redirect occurring and on the application sending custom credential headers or, for 307 and 308 responses, sensitive request-body data.
How can I remediate the issue?
Upgrade to MCP Python SDK version 1.30.0 or 2.2.0, which contain the fix. If an immediate upgrade is not possible, avoid using affected client paths with caller-supplied credential headers against endpoints whose redirect destinations may be influenced.