MediumVulnerability

GHSA-6prh-2h8m-c8cw: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-111769GHSA-6prh-2h8m-c8cw
Published: October 20, 2026
Record updated: October 20, 2026

Affected: @modelcontextprotocol/client >= 2.0.0, < 2.3.0, fixed in 2.3.0
@modelcontextprotocol/sdk < 1.32.0, fixed in 1.32.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.

Summary

Affected versions of the MCP TypeScript SDK, including @modelcontextprotocol/sdk through 1.31.0 and @modelcontextprotocol/client 2.0.0 through 2.2.0, followed HTTP redirects to any origin in StreamableHTTPClientTransport, SSEClientTransport and the OAuth client functions such as auth(). A cross-origin redirect sent custom headers such as X-API-Key and the mcp-session-id header to the new origin, and on a 307 or 308 response it also sent the request body, including OAuth refresh_token and client_secret values. stdio clients are not affected.

Mitigation

Upgrade @modelcontextprotocol/sdk to 1.32.0 or later, or @modelcontextprotocol/client to 2.3.0 or later. Redirects are now followed only within the same origin, and not at all in browsers. If a redirect may have reached a host you do not control, rotate the API keys and client_secret and revoke tokens. If you cannot upgrade yet, pass a fetch that refuses redirects, for example (url, init) => fetch(url, { ...init, redirect: 'error' }).

Details

Scores and exploitation

Patch available: Yes
EPSS: Not scored. FIRST had not published an EPSS score for this CVE when it was last checked on October 20, 2026.
Disclosure date: October 20, 2026

Affected

Packages: @modelcontextprotocol/client@>= 2.0.0, < 2.3.0 (fixed: 2.3.0)
@modelcontextprotocol/sdk@< 1.32.0 (fixed: 1.32.0)
Vendors: Anthropic

Classification

Attack type: Other
Attack sophistication: Moderate
AI component targeted: API
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-6prh-2h8m-c8cw

First tracked: October 20, 2026 at 08:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 85% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

@modelcontextprotocol/clientnpmNo LLM dependency detected · 2 tracked dependents
@modelcontextprotocol/sdknpmLLM dependency since 2024-11-11 · 18 tracked dependents

Topics

Model Context Protocol

Summary

Mitigation

Affected packages in the Exposure Registry

Topics

Related items