CVE-2026-116685 in python-sdk
Summary
by MITRE • 10/27/2026
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The Model Context Protocol Python SDK serves as the official software development kit for implementing servers and clients within the MCP ecosystem, facilitating communication between large language models and external tools or data sources. A significant security vulnerability was identified in specific client-side components of this library, affecting versions ranging from 1.8.0 up to 1.30.0 and version 2.2.0. The flaw resides primarily within the HTTP client implementations, specifically impacting streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth integration modules, and the create_mcp_http_client factory function. These components are responsible for managing network requests and handling responses from remote endpoints that provide context or execute actions on behalf of the application.
The core technical flaw involves an improper handling of HTTP redirect behaviors when following redirects to a different origin. In standard web security practices, it is critical to prevent credential leakage during cross-origin redirections because browsers typically strip sensitive headers like Authorization cookies upon such transitions. However, the vulnerable SDK implementations were configured with follow_redirects enabled in a manner that did not adequately sanitize or restrict custom credential headers when crossing domain boundaries. Consequently, if an attacker can manipulate a trusted endpoint's redirect destination to point toward a malicious server under their control, the client will automatically forward these sensitive authentication tokens and other caller-supplied credentials to the unauthorized third-party origin. This behavior effectively bypasses standard cross-origin security expectations that rely on browser-level protections or explicit developer configuration to prevent such leakage.
Furthermore, for HTTP responses with status codes 307 Temporary Redirect and 308 Permanent Redirect, the vulnerability extends beyond header leakage to include the forwarding of the original request body. These specific status codes are designed to preserve the method and payload of the initial request during redirection. By automatically relaying this data to a different origin without adequate validation or restriction, the SDK exposes potentially sensitive input data submitted by users or internal systems. An attacker leveraging this flaw can intercept not only authentication credentials but also any private information contained within POST bodies, query parameters, or other transmitted payloads intended for the legitimate service provider. This creates a severe risk of unauthorized access and data exfiltration, as the malicious redirect destination gains full visibility into what would otherwise be protected communications.
From an industry standard perspective, this vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where the server makes requests to unintended destinations, often leading to credential leakage or internal network access. It also relates closely to CWE-524, concerning the use of cacheable credentials in a way that exposes them to unauthorized parties through improper redirection handling. In terms of offensive security tactics, this behavior facilitates ATT&CK technique T1078, Valid Accounts, by allowing attackers to harvest valid authentication tokens from legitimate users or services. Additionally, it supports data exfiltration strategies under the broader category of Collection and Exfiltration techniques found in the MITRE ATT&CK framework, as sensitive body content is transmitted out-of-band to an attacker-controlled server.
The operational impact of this vulnerability is substantial for any application relying on the Model Context Protocol SDK for integrating with external services that utilize redirects. Attackers who can influence redirect targets through social engineering, compromised upstream servers, or DNS manipulation can silently steal session tokens and sensitive user data without triggering typical security alerts associated with direct unauthorized access attempts. This undermines the confidentiality integrity of the entire MCP integration layer, potentially leading to account takeover, privilege escalation within connected systems, and exposure of proprietary business logic embedded in request bodies.
To mitigate this risk, organizations must immediately upgrade their dependencies to version 1.30.0 or later for the stable branch and version 2.2.0 or later for the newer release track where these issues have been resolved. The fix involves implementing stricter controls over redirect behavior, ensuring that custom credential headers are stripped when crossing origin boundaries unless explicitly permitted by secure configuration policies. Developers should also audit their usage of streamable_http_client and related modules to ensure they adhere to least-privilege principles regarding network access. Regular security assessments and dependency scanning tools should be employed to detect outdated versions of the SDK in production environments, preventing exploitation until patches are fully deployed across all affected systems.