CVE-2026-116685

MCP Python redirects can forward custom credentials and request bodies

Model Context Protocol · Python SDK HTTP and OAuth clients

First documented disclosure · Review checkpoint

Summary

A trusted endpoint’s cross-origin redirect can disclose custom headers or request bodies.

Severity and exploitation evidence

Medium · 5.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

HTTP transports and OAuth requests follow redirects beyond the configured origin; 307/308 responses can replay the body.

Conditions required

An attacker can influence a trusted endpoint’s redirect target; the client follows redirects and carries sensitive custom headers or body data.

Potential impact

Exposure of custom API-key headers and replayed request bodies to the destination; a lone Authorization bearer header is stripped by the HTTP library.

Affected versions and configurations

mcp >=1.8.0, <1.30.0; >=2.0.0, <2.2.0. Servers and stdio-only clients are unaffected.

Fix and mitigation status

1.30.0 and 2.2.0.

Practical next steps

Upgrade, use the final trusted endpoint URL, and rotate credentials if a client followed a redirect to an untrusted host. A client with follow_redirects=False is an interim option where supported.

Operating lesson

A redirect is a new trust decision for credentials and request contents.

Evidence and limits

The public fix PR dates to August 26, the advisory to October 2 and CVE publication to October 27. A malicious server already receives its own requests; the added exposure is a trusted endpoint redirecting elsewhere.

Sources