Vulnerability · CVE-2026-116685
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · Model Context Protocol Python
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116685. EPSS is 0.40%. Act only if a listed version of Model Context Protocol Python is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Model Context Protocol Python).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium5.9
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.40%
- Remediation
- Version ranges on file
- Affected products
- PyPI mcp · pip mcp · pypi mcp
### Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an credential) were sent to that origin, and - on a or redirect the request body was re-sent there too. The SDK's OAuth client providers followed redirects on their own discovery, registration and token requests in the same way. A lone bearer header was not exposed; the HTTP library already drops it on cross-origin redirects. Anyone able to make an endpoint you trust redirect elsewhere (a stale redirect to a lapsed domain, a misrouted proxy rule, redirect logic an attacker can influence) could capture that material. A server that is itself malicious gains nothing this way; it already receives your requests directly. ### Am I affected? Yes, if your code uses the SDK as an MCP client over HTTP through any of: - (on 2.x also given an or URL) - or - with HTTP server parameters - the internal helper This includes an HTTP client you passed in yourself with . Affected versions: 1.8.0 through 1.29.1, and 2.0.0 through 2.1.1. Not affected: - MCP servers - stdio clients - a client you supplied with left at its default of ### Fix Upgrade to 1.30.0 (1.x) or 2.2.0 (2.x) or later; no code changes are needed. The transports, and the OAuth providers' own requests, now follow a redirect only when it stays on the endpoint's origin (same scheme, host and port, or an to upgrade on the same host) and keeps the request method. Any other redirect is not followed and the request fails with an error naming the target ( on 2.x, on 1.x), whichever HTTP client the transport uses. The internal helper no longer turns redirect following on, so code calling it directly now receives the redirect response instead. If your client currently reaches its server through a redirect to another host, including a server that needs no credentials, it will stop con
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI mcp1.8.0 → 1.30.0
- PyPI mcp2.0.0 → 2.2.0
- pip mcp>= 1.8.0, < 1.30.0
- pip mcp>= 2.0.0, < 2.2.0
- pypi mcpversion unspecified
How to fix CVE-2026-116685
Upgrade
CVE-2026-116685 lists a fix boundary at 1.30.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 1.30.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116685. EPSS is 0.40%. Act only if a listed version of Model Context Protocol Python is installed.
Which versions are affected?
Compare what you have installed with 1.8.0 → 1.30.0, 2.0.0 → 2.2.0, >= 1.8.0, < 1.30.0, >= 2.0.0, < 2.2.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-200: Exposure of Sensitive Information. EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
### Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an credential) were sent to that origin, and - on a or redirect the request body was re-sent there too. The SDK's OAuth client providers followed redi
Oct 27, 2026 · GitHub Advisory Database
Updated
### Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an credential) were sent to that origin, and - on a or redirect the request body was re-sent there too. The SDK's OAuth client providers followed redi
Oct 27, 2026 · PyPA Advisory Database
Fix available
mcp fixed in 2.2.0; mcp fixed in 1.30.0
Oct 27, 2026 · PyPA Advisory Database
Fix available
mcp fixed in 2.2.0
Oct 27, 2026 · PyPA Advisory Database
Fix available
mcp fixed in 1.30.0
Oct 27, 2026 · PyPA Advisory Database
Updated
### Summary In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an credential) were sent to that origin, and - on a or redirect the request body was re-sent there too. The SDK's OAuth client providers followed redi
Sources
- CVE.orgVulnerability recordCVE-2026-116685
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116685
30-day exploitation probability 0.40%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-5h93-6whr-6q8j
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116685
In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: custom headers set on the client (for example an X-API-Key credential) were sent to that origin, and on a 307 or 308 redirect the request body was re-sent there too. The SDK's OAuth client providers followed re
advisories.gitlab.com - PyPA Advisory DatabasePackage advisoryGHSA-5h93-6whr-6q8j
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- CVE.orgOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026
- GitHub Advisory DatabaseOct 28, 2026