CVE-2026-116685mediumCWE-200

CVE-2026-116685: medium-severity vulnerability in modelcontextprotocol python-sdk

Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Published · Updated

Follow this CVE+ Monitor python-sdk+ Monitor mcp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.4%
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
modelcontextprotocol · python-sdk
Related CVEs — modelcontextprotocol python-sdk

In the same product, most dangerous first.

CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 9.8%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2025-66416HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-52869HIGHMCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalEPSS 0.5%CVE-2026-59951MEDIUMMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionEPSS 0.5%CVE-2025-53365HIGHMCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of ServiceEPSS 0.4%