CVE-2026-116685 modelcontextprotocol CVE debrief

Who should care

Defenders and developers using the Model Context Protocol Python SDK, especially those using streamable_http_client, streamablehttp_client, sse_client, or ClientSessionGroup with HTTP server parameters, should assess exposure and apply patches.

Why it matters

The Model Context Protocol Python SDK's behavior of following cross-origin redirects with custom headers and bodies could lead to unintended exposure of sensitive information. Defenders should prioritize verifying the SDK version and applying patches to prevent potential information exposure. This vulnerability affects users of streamable_http_client, streamablehttp_client, sse_client, and ClientSessionGroup with HTTP server parameters.

• Potential exposure of sensitive information such as API keys.
• Possible unauthorized access to sensitive data through influenced redirect logic.
• Need for verification of SDK versions and application of patches.
• Potential for data breaches if an attacker can influence the redirect logic of a trusted endpoint.

Technical summary

The Model Context Protocol Python SDK's HTTP client transports followed HTTP redirects to any host, potentially exposing custom headers and request bodies to unintended origins. This behavior affects users of streamable_http_client, streamablehttp_client, sse_client, and ClientSessionGroup with HTTP server parameters. The vulnerability could lead to unintended exposure of sensitive information if an attacker can influence the redirect logic of a trusted endpoint. Defenders should prioritize verifying the SDK version and applying patches to prevent potential information exposure.

Defensive priority

Defenders should prioritize verifying the SDK version and applying patches to prevent potential information exposure.

Recommended defensive actions

• Verify the SDK version and apply patches to prevent potential information exposure.
• Review and update configurations for streamable_http_client, streamablehttp_client, sse_client, and ClientSessionGroup with HTTP server parameters.
• Assess exposure for systems using the affected SDK versions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides details on the affected SDK versions and the conditions under which custom headers and request bodies could be sent to an unintended origin. Specifically, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host, potentially exposing custom headers and request bodies to unintended origins. The source item provides additional information on the vulnerability, including the affected SDK versions and the potential impact on systems using these versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.