Model Context Protocol SDK leaks headers on cross-origin redirects
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The Model Context Protocol TypeScript SDK in @modelcontextprotocol/sdk before 1.32.0 and @modelcontextprotocol/client from 2.0.0 before 2.3.0 follows cross-origin redirects in its HTTP client transports and OAuth requests. It re-sends custom headers and, for HTTP 307 or 308 responses, request bodies, which exposes sensitive information (CWE-200). A malicious or compromised server at the redirect target can receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | typescript-sdk | before 1.32.0 | 1.32.0 | Patch available | CNA |
| MLflow | sdk | before 1.32.0 | 1.32.0 | Patch available | CNA |
| MLflow | client | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | CNA |
| — | @modelcontextprotocol/sdk (npm) | before 1.32.0 | 1.32.0 | Patch available | GHSA-6prh-2h8m-c8cw |
| — | @modelcontextprotocol/client (npm) | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | GHSA-6prh-2h8m-c8cw |
- typescript-sdk VendorMLflow Affected before 1.32.0 Fixed in 1.32.0 Patch available CNA
- sdk VendorMLflow Affected before 1.32.0 Fixed in 1.32.0 Patch available CNA
- client VendorMLflow Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
- @modelcontextprotocol/sdk (npm) Vendor— Affected before 1.32.0 Fixed in 1.32.0 Patch available GHSA-6prh-2h8m-c8cw
- @modelcontextprotocol/client (npm) Vendor— Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-6prh-2h8m-c8cw
Remediation
Upgrade @modelcontextprotocol/sdk to 1.32.0 and @modelcontextprotocol/client to 2.3.0. Do not restore unrestricted redirect following after upgrading, because that restores the exposure.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA typescript-sdk (modelcontextprotocol) Fixed in 1.32.0
- Fix · CNA sdk (@modelcontextprotocol) Fixed in 1.32.0
- Fix · CNA client (@modelcontextprotocol) Fixed in 2.3.0
- Fix · GHSA-6prh-2h8m-c8cw @modelcontextprotocol/sdk (npm) Fixed in 1.32.0 Advisory →
- Fix · GHSA-6prh-2h8m-c8cw @modelcontextprotocol/client (npm) Fixed in 2.3.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-11-05 Threatist record created from CVE-2026-111769
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 8
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2901
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2902
- https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d
- https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0
- https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/[email protected]
- https://github.com/modelcontextprotocol/typescript-sdk
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-111769 · CVE Program
- CVE-2026-111769 · NVD
- FIRST EPSS
- CVE-2026-111769 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences