Security brief

MCP Python SDK redirects could leak custom headers and request bodies

REVIEW

HTTP-client redirect behaviour could expose custom credentials and request bodies. Check transport settings and upgrade affected SDK versions.

Published 29 Oct 2026 · Material update 27 Oct 2026 — last time the underlying evidence changed · Evidence: high

What happened

A redirect can move sensitive information beyond the endpoint a developer intended to trust. The MCP Python SDK advisory describes this risk in its HTTP client transports.

A cross-origin redirect could forward custom credential headers. HTTP 307 and 308 redirects could also resend request bodies. A lone Authorization bearer header was excluded: the HTTP library already removes it on cross-origin redirects.

Affected versions and fix

Affected ranges are >=1.8.0, <1.30.0 and >=2.0.0, <2.2.0. Upgrade to the corresponding fixed release, 1.30.0 or 2.2.0, or a later supported version.

The advisory excludes MCP servers, stdio clients, and supplied HTTP clients with redirect following disabled.

Read advisory GHSA-5h93-6whr-6q8j.

Who should check?

Teams running MCP Python SDK HTTP clients with redirect following enabled.

Next step

Check the client transport and SDK version against the advisory; upgrade the affected release branch.

What we know

Affected clients: HTTP clients with redirect following enabled
Fixed releases: 1.30.0 / 2.2.0

What remains unknown

Open question: This review does not establish whether a particular deployment leaked information.

Source references

GIT

GitHub Advisory Database Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Technical details

CVE: CVE-2026-116685