Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
影響: pip:mcp >= 2.0.0, < 2.2.0 → 2.2.0, pip:mcp >= 1.8.0, < 1.30.0 → 1.30.0
In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host. If the configured MCP endpoint answered with a redirect to a different origin: - custom headers set on the client (for example an X-API-Key credential) were sent to that origin, and - on a 307 or 308 redirect the request body was re-sent there too. The SDK's OAuth client providers followed redirects on their own discovery, registration and token requests in the same way. A lone Authori…
| CVE | CVE-2026-116685 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:17 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 06:05, GitHub Advisory Database에서 "Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-116685.