TypeScript SDK Redirection Vulnerability in Model Context Protocol by ModelContextProtocol

CVE-2026-111769

What is CVE-2026-111769?

The TypeScript SDK of the Model Context Protocol allowed certain HTTP clients to follow redirects to different origins while retaining custom request headers and potentially sensitive request bodies. This was due to improper handling of HTTP 307 and 308 responses. Specifically, OAuth request bodies could be reused without sufficient safeguards against unauthorized access, risking exposure of vital credentials like API keys and OAuth tokens to malicious third parties. Upgrading to the patched versions mitigates this serious risk, restoring the integrity of secure communications and safeguarding user data.

References