## MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-111769
- 公開日時: 2026-10-20T18:26:30.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-6prh-2h8m-c8cw)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-6prh-2h8m-c8cw

影響: npm:@modelcontextprotocol/sdk < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/client >= 2.0.0, < 2.3.0 → 2.3.0
Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an X-API-Key set in requestInit.headers) and the mcp-session-id header. On a 307 or 308 it also received the request body, including OAuth token requests with their refresh_token and client_secret. On current runtimes fetch already drops the Authori…