CVE-2026-116685 Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

CVE-2026-116685

The Model Context Protocol Python SDK is vulnerable in versions 1.8.0 up to 1.30.0 and 2.2.0 due to how its HTTP client transports handle redirects. Specifically, the streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client paths may follow ...

CVE-2026-116685 Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

SUSE CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

UBUNTU-CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

DEBIAN-CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

EUVD-2026-109448

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

CVE-2026-116190

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as...

PT-2026-123031

Name of the Vulnerable Software and Affected Versions rclone versions 1.56.0 through 1.75.1 Description The WebDAV backend contains an issue where operator-configured custom credential headers are forwarded to different hosts during HTTP 3xx redirects. An attacker capable of controlling or...

AZL-110088 CVE-2026-111756 affecting package python-tensorboard 2.16.2-6

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

AZL-109829 CVE-2026-111756 affecting package js-jquery 3.5.0-4

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756 follow-redirects array-form headers bypass cross-origin credential stripping

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

CVE-2026-111756

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders before followi...

npm: follow-redirects sensitiveHeaders regex escaping can expose credential headers

npm: follow-redirects sensitiveHeaders regex escaping can expose credential headers vulnerability discovered by ? in WordPress npm follow-redirects versions = 1.16.0, 1.16.1...

follow-redirects sensitiveHeaders regex escaping can expose credential headers

Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...

GHSA-8R9P-F939-6H3C follow-redirects sensitiveHeaders regex escaping can expose credential headers

Summary follow-redirects 1.16.0 introduced the sensitiveHeaders option the fix for CVE-2026-40895 / GHSA-r4q5-vmmm-2653, which lets an application declare extra header names that must be removed when a redirect crosses to a different host or downgrades protocol. The filter is a single...

CVE-2026-111755

A flaw was found in follow-redirects. This vulnerability allows an untrusted remote server to receive sensitive credential headers due to improper handling of cross-origin redirects. When an application specifies sensitive headers containing special regular expression characters, the library fail...