MCP Python SDK cross-origin HTTP redirect credential leakage advisory

Evidence record

Python MCP SDK cross-origin HTTP/SSE/OAuth redirect advisory. Distinguishes leaked custom headers and replayed bodies from Authorization, which HTTPX already stripped; fixes in mcp 1.30.0/2.2.0.

Read the original source ↗

Claim-level citations (3)

• supportsPython MCP client forwarded custom credentials and request bodies across origins: CVE-2026-116685 affects Streamable HTTP, SSE and certain OAuth client requests that followed cross-origin redirects with custom credential headers.

  Advisory summary; affected client transports

• supportsPython MCP client forwarded custom credentials and request bodies across origins: The advisory distinguishes custom headers and replayed bodies from a standard Authorization bearer header, which the underlying HTTP client already removed on cross-origin redirects.

  Advisory summary; Authorization header exception

• supportsPython MCP client forwarded custom credentials and request bodies across origins: The HTTP redirect flaw did not expose a lone Authorization bearer header, which the HTTP client already removed; custom X-API-Key headers and 307/308 request bodies could still cross origins.

  Summary and affected HTTP clients, GHSA-5h93-6whr-6q8j