Security2 hOctober 28, 2026, 12:30

MCP Python SDK leaks credentials via cross-origin redirects

CVE-2026-116685 (CVSS 5.9) affects the MCP Python SDK versions 1.8.0–1.29.1 and 2.0.0–2.1.1: the HTTP client follows redirects to external origins and forwards custom auth headers such as X-API-Key, replaying POST bodies on 307/308 responses. Versions 1.30.0 and 2.2.0 restrict redirects to the original endpoint origin.

DEV Community

Open source

MCP Python SDK leaks credentials via cross-origin redirects

Affects mcp 1.8.0–1.29.1 and 2.0.0–2.1.1, CVSS 5.9
Custom headers like X-API-Key are sent to external hosts
HTTP 307/308 redirects replay the full POST body
Fixed in mcp 1.30.0 and 2.2.0 with same-origin redirects

#MCP

MCP Python SDK flaw lets malicious servers steal OAuth credentials

Security

MCP Python SDK flaw enables SSRF and event-loop DoS via outputSchema

Security

MCP server SDK flaw leaked one client's replies to another via JSON-RPC id

Security

MCP Python SDK leaks credentials via cross-origin redirects

MCP Python SDK flaw lets malicious servers steal OAuth credentials

MCP Python SDK flaw enables SSRF and event-loop DoS via outputSchema

MCP server SDK flaw leaked one client's replies to another via JSON-RPC id

MCP SDK OAuth fix audit: patching alone leaves the hole open