MCP Python SDK 出現 CVE-2026-116685 跨來源重新導向資料外洩漏洞

CVE-2026-116685: Cross-Origin Redirect Credential and Request Payload Disclosure in MCP Python SDK

Vulnerability ID: CVE-2026-116685
CVSS Score: 5.9
Published: 2026-10-27

CVE-2026-116685 (GHSA-5h93-6whr-6q8j) is a sensitive information disclosure vulnerability in the official Model Context Protocol (MCP) Python SDK (mcp on PyPI). In versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, the SDK's HTTP-based client transports—including Streamable HTTP, Server-Sent Events (SSE), and OAuth client flows—unconditionally enable automatic HTTP redirect following (follow_redirects=True) across origin boundaries. When a configured endpoint returns a redirect to an external origin, the HTTP client forwards caller-supplied custom authentication headers (such as X-API-Key) and, in the case of HTTP 307 or 308 responses, replays the full POST request body containing JSON-RPC payloads or OAuth parameters to the untrusted destination.

TL;DR

The Model Context Protocol (MCP) Python SDK (mcp versions 1.8.0–1.29.1 and 2.0.0–2.1.1) unconditionally follows cross-origin HTTP redirects in its Streamable HTTP, SSE, and OAuth client transports. If a trusted MCP server or intermediate proxy redirects a client to an external domain, custom credential headers (e.g., X-API-Key) and HTTP 307/308 POST request bodies are transmitted to the external host. Users should upgrade to version 1.30.0 or 2.2.0, which restrict redirect traversal strictly to the original endpoint origin.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-116685 (GHSA-5h93-6whr-6q8j)
Weakness Class: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS v3.1 Score: 5.9 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Package: mcp (PyPI) >= 1.8.0, < 1.30.0 and >= 2.0.0, < 2.2.0
Patched Versions: 1.30.0 (1.x branch) and 2.2.0 (2.x branch)
Attack Vector: Network (Cross-Origin HTTP 3xx Redirects on MCP Client Transports)
Primary Impact: Leakage of custom credential headers (e.g., X-API-Key) and HTTP 307/308 POST bodies
CISA KEV Status: Not Listed

Affected Systems

Model Context Protocol (MCP) Python SDK (mcp PyPI package)
mcp (Python SDK): >= 1.8.0, < 1.30.0 (Fixed in: 1.30.0)
mcp (Python SDK): >= 2.0.0, < 2.2.0 (Fixed in: 2.2.0)

Code Analysis

Commit: c6762e8

Restrict HTTP client redirects to the endpoint origin (#3397) - v2.x remediation

Commit: 2106335

Restrict HTTP client redirects to the endpoint origin (v1.x) (#3448) - v1.x backport

Commit: 9771e6b

Allow same-origin redirects when original URL has userinfo (#3450)

Mitigation Strategies

Upgrade the mcp Python package to version 1.30.0+ (for 1.x) or 2.2.0+ (for 2.x) to enforce same-origin redirect restrictions across all HTTP, SSE, and OAuth client transports.
Explicitly disable automatic HTTP redirect following (follow_redirects=False) on custom httpx.AsyncClient instances or httpx_client_factory callables passed to MCP client transports if immediate upgrading is blocked.
Configure reverse proxies and TLS terminators fronting MCP servers to forward X-Forwarded-Proto headers and use canonical endpoint URLs so legitimate requests do not trigger cross-scheme redirects.
Rotate any custom API keys (X-API-Key) or proprietary authentication tokens used by MCP clients that communicated with endpoints susceptible to open redirects or third-party domain redirects.

Remediation Steps:

Identify all Python environments and container images using the mcp package (pip show mcp or inspect requirements.txt, pyproject.toml, uv.lock, or poetry.lock).
For projects on the 1.x branch, run pip install --upgrade "mcp>=1.30.0,<2.0.0".
For projects on the 2.x branch, run pip install --upgrade "mcp>=2.2.0".
Verify that MCP client connections do not rely on cross-origin redirects; update client configuration URLs to point directly to the final destination origin if previously relying on external redirectors.
Rotate any custom credential headers that may have been exposed prior to patching.

References

Read the full report for CVE-2026-116685 on our website for more details including interactive diagrams and full exploit analysis.