GHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

Summary

The Model Context Protocol Python SDK's Streamable HTTP and SSE client transports, and its OAuth client providers, followed HTTP redirects to any host. Custom headers such as an X-API-Key credential were sent to the redirect target, and on 307 or 308 redirects the request body was re-sent too, while a lone Authorization bearer header was dropped by the HTTP library. Affected versions are 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1, and exploitation requires a trusted endpoint to redirect to a different origin.

Mitigation

Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later; no code changes are needed. Until upgrading, supply your own HTTP client with follow_redirects left at False (http_client= on streamable_http_client; httpx_client_factory= on sse_client and streamablehttp_client), and rotate any credentials a client may have sent to a host you do not control.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mcpPyPILLM dependency since 2024-11-20 · 61 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSame vendor · GitHub Advisory Database
• HighGHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthSame vendor · GitHub Advisory Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSame vendor · GitHub Advisory Database
• HighGHSA-22jm-h49p-29qw: MCP TypeScript SDK: Experimental tasks were not tied to the session that created themSame vendor · GitHub Advisory Database