MCP Python clients could forward credentials through redirects

What happened

A trusted MCP endpoint’s redirect could send custom credential headers to another website. Redirects that preserve the HTTP method could also forward the request body.

The repository advisory was published on 2 October; the CVE and global advisory index followed on 27 October. Affected mcp versions are 1.8.0 up to 1.30.0 and 2.0.0 up to 2.2.0, excluding the upper endpoints. Versions 1.30.0 and 2.2.0 fix the issue; both release receipts are dated 7 September. Exploitation requires influence over a trusted endpoint’s redirect. A lone Authorization header was already stripped by the underlying HTTP client; custom headers and 307/308 bodies create the exposure described here.