CVE-2026-116685: Model Context Protocol Python SDK credential and body leak on cross-origin redirects

CVE-2026-116685 · Severity: medium · CVSS 5.9 · Published 2026-10-27

The Model Context Protocol Python SDK is used to build AI assistants that interact with local services and APIs. Multiple client functions in versions 1.8.0 through 1.30.0 and 2.2.0 follow HTTP redirects to different servers while forwarding caller-supplied authentication credentials and request bodies, allowing an attacker who controls a redirect target to steal those credentials and sensitive data.

Technologies: Anthropic Model Context Protocol Python SDK, mcp (PyPI). Vendors: Anthropic, PyPI.

Quick answers

Is CVE-2026-116685 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-116685 being exploited in the wild.
How severe is CVE-2026-116685?
Medium severity, with a CVSS score of 5.9, published 27 October 2026.
Which products and versions are affected?
Anthropic Model Context Protocol Python SDK 1.8.0 to 1.30.0, 2.0.0 to 2.2.0; mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.
Is there a fix for CVE-2026-116685?
Yes. mcp (PyPI): upgrade to 2.2.0 or later. Until then: Restrict HTTP redirects to the same origin, and ensure that custom authentication headers and request bodies are never forwarded to redirect destinations on different origins. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116685 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-116685?
Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp (PyPI): upgrade to 2.2.0 or later
    pip install "mcp>=2.2.0"

Restrict HTTP redirects to the same origin, and ensure that custom authentication headers and request bodies are never forwarded to redirect destinations on different origins.

Technical details

The vulnerability is an improper redirect validation flaw in streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client functions. These functions enable HTTP redirects by default without validating that the redirect destination remains on the same origin, causing custom authentication headers and request bodies (for 307/308 responses) to be forwarded to attacker-controlled servers. An attacker who can influence a trusted MCP endpoint's redirect destination gains access to bearer tokens and other credentials embedded in client requests.

Affected products

  • Anthropic Model Context Protocol Python SDK 1.8.0 to 1.30.0, 2.0.0 to 2.2.0

Identifiers

  • CVE-2026-116685
  • GHSA-5h93-6whr-6q8j

Timeline

  • 2026-10-27: disclosed
  • 2026-09-04: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.