The client follows an HTTP redirect while keeping caller-provided authentication headers and, for 307 or 308, the request body. An attacker who can alter a trusted endpoint’s redirect destination can intercept the forwarded custom credentials. CVE-2026-116685 affects Streamable HTTP, SSE and certain OAuth client requests that followed cross-origin…
Inspect the ClaimsCase · DiggingBeagle record
Python MCP client forwarded custom credentials and request bodies across origins
A redirect from a connected MCP endpoint could carry nonstandard API-key headers to an unrelated host.
Scope
An attacker must influence a trusted endpoint or its redirect chain. Stdio clients and server-only implementations are not affected, and a malicious destination already selected as the base endpoint is a different trust problem.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The advisory isolates cross-origin redirects in MCP HTTP/SSE and OAuth requests, which could forward client-supplied custom credentials or replayed 307/308 bodies. Standard Authorization bearer headers were already dropped by the HTTP client. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-027-A · CLM-CP22-027-B · CLM-ENRICH-20261028-012 · MCP Python SDK cross-origin HTTP redirect credential leakage advisory
At a glance
Which clients embedded long-lived custom keys and which redirects were encountered in production remains unknown.
Limits and uncertaintyFull account
The client follows an HTTP redirect while keeping caller-provided authentication headers and, for 307 or 308, the request body. An attacker who can alter a trusted endpoint’s redirect destination can intercept the forwarded custom credentials.
CVE-2026-116685 affects Streamable HTTP, SSE and certain OAuth client requests that followed cross-origin redirects with custom credential headers. The advisory distinguishes custom headers and replayed bodies from a standard Authorization bearer header, which the underlying HTTP client already removed on cross-origin redirects. Primary evidence.
An attacker must influence a trusted endpoint or its redirect chain. Stdio clients and server-only implementations are not affected, and a malicious destination already selected as the base endpoint is a different trust problem.
Upgrade the MCP Python SDK to 1.30.0 or 2.2.0 or later, deny cross-origin redirects and test every credential-bearing header and body before tool execution.
Claims & evidence
CLM-CP22-027-ACVE-2026-116685 affects Streamable HTTP, SSE and certain OAuth client requests that followed cross-origin redirects with custom credential headers.supported
Basis: reported finding
- supportsMCP Python SDK cross-origin HTTP redirect credential leakage advisoryprimary disclosure
Advisory summary; affected client transports
CLM-CP22-027-BThe advisory distinguishes custom headers and replayed bodies from a standard Authorization bearer header, which the underlying HTTP client already removed on cross-origin redirects.supported
Basis: reported finding
- supportsMCP Python SDK cross-origin HTTP redirect credential leakage advisoryprimary disclosure
Advisory summary; Authorization header exception
CLM-ENRICH-20261028-012The HTTP redirect flaw did not expose a lone Authorization bearer header, which the HTTP client already removed; custom X-API-Key headers and 307/308 request bodies could still cross origins.supported
Basis: reported finding
- supportsMCP Python SDK cross-origin HTTP redirect credential leakage advisoryprimary disclosure
Summary and affected HTTP clients, GHSA-5h93-6whr-6q8j
Controls and mitigations
- Upgrade the MCP Python SDK to 1.30.0 or 2.2.0 or later, deny cross-origin redirects and test every credential-bearing header and body before tool execution.
Unknowns and contradictions
- Which clients embedded long-lived custom keys and which redirects were encountered in production remains unknown.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199