Medium severity · published Oct 27, 2026
CVE-2026-116685
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
New
5.9
CVSS
–
EPSS
No
On KEV
Description
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-sdk · modelcontextprotocol
>= 1.8.0, < 1.30.0; >= 2.0.0, < 2.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116685
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116685
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e
github.com
https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3397
github.com
https://github.com/modelcontextprotocol/python-sdk/pull/3448
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
github.com
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
More from python-sdk
8.1
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
7.6
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
7.1
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
6.9
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion