# CVE-2026-116685: Model Context Protocol Python SDK credential and body leak on cross-origin redirects

Source: https://junglewise.ai/threats/cve-2026-116685-the-model-context-protocol-python-sdk-is-the-official-python-sdk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116685 · Severity: medium · CVSS 5.9 · Published 2026-10-27

The Model Context Protocol Python SDK is used to build AI assistants that interact with local services and APIs. Multiple client functions in versions 1.8.0 through 1.30.0 and 2.2.0 follow HTTP redirects to different servers while forwarding caller-supplied authentication credentials and request bodies, allowing an attacker who controls a redirect target to steal those credentials and sensitive data.

Technologies: [Anthropic Model Context Protocol Python SDK](https://junglewise.ai/threats/technologies/anthropic-model-context-protocol-python-sdk), [mcp (PyPI)](https://junglewise.ai/threats/technologies/pypi-mcp). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116685 being exploited in the wild.

**How severe is CVE-2026-116685?** Medium severity, with a CVSS score of 5.9, published 27 October 2026.

**Which products and versions are affected?** Anthropic Model Context Protocol Python SDK 1.8.0 to 1.30.0, 2.0.0 to 2.2.0; mcp (PyPI) >= 2.0.0, < 2.2.0, ECOSYSTEM:introduced=2.0.0,fixed=2.2.0.

**Is there a fix for CVE-2026-116685?** Yes. mcp (PyPI): upgrade to 2.2.0 or later. Until then: Restrict HTTP redirects to the same origin, and ensure that custom authentication headers and request bodies are never forwarded to redirect destinations on different origins. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116685 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116685?** Check whether you run Anthropic Model Context Protocol Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp (PyPI): upgrade to 2.2.0 or later

  ```sh
  pip install "mcp>=2.2.0"
  ```


Restrict HTTP redirects to the same origin, and ensure that custom authentication headers and request bodies are never forwarded to redirect destinations on different origins.

## Technical details

The vulnerability is an improper redirect validation flaw in streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client functions. These functions enable HTTP redirects by default without validating that the redirect destination remains on the same origin, causing custom authentication headers and request bodies (for 307/308 responses) to be forwarded to attacker-controlled servers. An attacker who can influence a trusted MCP endpoint's redirect destination gains access to bearer tokens and other credentials embedded in client requests.

## Affected products

- Anthropic Model Context Protocol Python SDK 1.8.0 to 1.30.0, 2.0.0 to 2.2.0

## Identifiers

- CVE-2026-116685
- GHSA-5h93-6whr-6q8j

## Timeline

- 2026-10-27: disclosed
- 2026-09-04: patched

## References

- [https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e](https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e)
- [https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99](https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99)

## Related threats

- [Model Context Protocol Python SDK unvalidated $ref fetching](https://junglewise.ai/threats/cve-2026-116686-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [Model Context Protocol Python SDK token resource confusion in bearer authentication](https://junglewise.ai/threats/cve-2026-116684-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [MCP Python SDK unbounded session accumulation in StreamableHTTP](https://junglewise.ai/threats/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in-streamablehttp)
- [modelcontextprotocol python-sdk missing origin validation in WebSocket transport](https://junglewise.ai/threats/cve-2026-59950-modelcontextprotocol-python-sdk-missing-origin-validation-in)
- [Model Context Protocol Python SDK missing authorization in experimental tasks](https://junglewise.ai/threats/cve-2026-52870-model-context-protocol-python-sdk-missing-authorization-in)