CVE-2026-116685

What it actually does

The vulnerability allows HTTP client components in the Model Context Protocol Python SDK to follow redirects across origins while forwarding caller-supplied custom credential headers and, for 307/308 responses, the full request body, enabling disclosure of authentication material to attacker-controlled endpoints.

Why it matters to the business

Organizations using affected SDK versions face risk of credential and data leakage during HTTP operations that encounter redirects, which could lead to unauthorized access, data exposure, or compliance violations; the issue is recent with low observed exploitation but requires prompt attention due to the sensitive nature of forwarded material.

How an attack unfolds

An attacker who can influence the redirect destination of a trusted endpoint configures a malicious target; when the vulnerable client follows the redirect, it forwards custom headers containing credentials and request bodies on certain status codes, allowing the attacker to capture the sensitive data.

How to fix it

Upgrade the Model Context Protocol Python SDK to version 1.30.0 or 2.2.0 or later; review and restrict follow_redirects behavior in client configurations for untrusted origins; disable automatic following of redirects where feasible until upgrades are complete.

How to confirm the fix worked

Confirm installed SDK version is 1.30.0 or 2.2.0 or higher; test client redirect handling in isolated environments to ensure credentials are not forwarded across origins; inspect code for use of streamable_http_client, sse_client, and related components.

Typical attack path

1. Identify applications using vulnerable versions of the Model Context Protocol Python SDK client paths
2. Compromise or control a redirect target reachable from a trusted endpoint
3. Trigger an HTTP request from the client that results in a cross-origin redirect
4. Capture forwarded credential headers and request bodies at the attacker-controlled endpoint

How to detect it

Review application and network logs for unexpected redirects from SDK client requests; search for patterns where custom headers or request bodies are sent to previously unseen domains following redirects; monitor for post-redirect traffic containing authentication artifacts.

What your security team should do

• Prioritize upgrade to fixed versions 1.30.0 or 2.2.0 within the next 48 hours given the two-day publication window
• Audit all code paths using affected client components for custom header usage and redirect handling
• Implement network monitoring for anomalous cross-origin redirects involving SDK traffic
• Temporarily disable redirect following in client setups until patches are applied