{"id":"CVE-2026-116685","summary":"Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies","details":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.","aliases":["GHSA-5h93-6whr-6q8j"],"modified":"2026-10-29T02:48:26.377035111Z","published":"2026-10-27T19:26:46.926Z","database_specific":{"cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116685.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116685.json"},{"type":"ADVISORY","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116685"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3397"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3448"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/modelcontextprotocol/python-sdk","events":[{"introduced":"ed25167fa5d715733437996682e20c24470e8177"},{"fixed":"8c2fa6eabacde869d75568e33b9d466b58c2f512"},{"introduced":"6f69a3758ebf2ee55ce050f58b470ce11af71133"},{"fixed":"9972c21aa42054fb1450c5fc614761ed11847ec6"},{"fixed":"2106335745563b2321b8c73fef2c12903d00aa6e"},{"fixed":"c6762e821c527925f0b617db216d00fbd1d0bf99"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"1.8.0"},{"fixed":"1.30.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"2106335745563b2321b8c73fef2c12903d00aa6e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"c6762e821c527925f0b617db216d00fbd1d0bf99"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.30.0","range":[{"fixed":"8c2fa6eabacde869d75568e33b9d466b58c2f512"}],"source":"REFERENCES_TAG"},{"range":[{"fixed":"9972c21aa42054fb1450c5fc614761ed11847ec6"}],"source":"REFERENCES_TAG","original_tag":"v2.2.0"}]}}],"versions":["v1.29.1","v2.1.1","v2.0.0","v2.1.0","v1.29.0","v1.28.1","v1.28.0","v1.27.2","v1.27.1","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.3","v1.23.2","v1.23.1","v1.23.0","v1.22.0","v1.21.1","v1.21.0","v1.20.0","v1.19.0","v1.18.0","v1.17.0","v1.16.0","v1.15.0","1.15.0","v1.14.1","v1.14.0","v1.13.1","v1.13.0","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.0","v1.10.1","v1.10.0","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.9.0","v1.8.1","v1.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116685.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}