CVE-2026-111769

MCP TypeScript redirects can forward secrets to another origin

Model Context Protocol maintainers · MCP TypeScript HTTP client and OAuth helpers

First documented disclosure · Review checkpoint

Summary

A redirect can expose custom headers or OAuth request bodies to a different host.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer describes exposed data and regression tests; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

HTTP clients follow cross-origin redirects; 307/308 preserve bodies containing refresh tokens or client secrets. Custom API-key and session headers can follow too.

Conditions required

An application uses HTTP/SSE transports or SDK OAuth helpers and an MCP or authorization endpoint issues an untrusted redirect.

Potential impact

Disclosure of forwarded credentials or request content; stdio clients are outside this path.

Affected versions and configurations

SDK before 1.32.0; @modelcontextprotocol/client 2.0.0 through 2.2.0.

Fix and mitigation status

SDK 1.32.0 and client 2.3.0 restrict redirects by default.

Practical next steps

Upgrade, configure the final endpoint URL and keep the restrictive redirect policy. Rotate secrets and revoke tokens if a redirect reached an untrusted host.

Operating lesson

Treat a redirect as a new destination requiring a fresh trust decision.

Evidence and limits

The September 30 patch predates the October 2 advisory/release and November 5 CNA. Current fetch runtimes already strip Authorization across origins; that does not protect custom headers or bodies. redirectPolicy=follow restores the exposure.

Sources