The HTTP client transport of the Model Context Protocol Python SDK previously followed cross-origin redirects and carried custom headers and request bodies
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
The Model Context Protocol Python SDK released a security advisory (CVE-2026-116685): versions from 1.8.0 to before 1.30.0 and from 2.0.0 to before 2.2.0 send custom headers and request bodies externally via cross-origin redirects, and this has been fixed in 1.30.0 and 2.2.0. In affected versions, the Streamable HTTP and SSE client transports follow redirects pointing to arbitrary hosts, sending client-set custom headers (such as X-API-Key credentials) to the redirect target, and 307/308 redirects also resend the request body; the same applies to the OAuth client provider's discovery, registration and token requests. The standalone Authorization bearer header is not exposed; MCP servers, stdio clients, and clients that keep follow_redirects at the default False are unaffected.
The advisory lists affected client usages and unaffected scenarios, and gives steps to upgrade, temporarily disable redirect following, and rotate credentials, so teams using the SDK can check themselves against it.