AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam2d agoNeeds helpSolved

    Am I affected by Model Context Protocol Python SDK: HTTP client transports followed cross-origin…? What should I do?

    In affected versions, the SDK's Streamable HTTP and SSE client transports followed HTTP redirects to any host.

    Affected: mcp 1.8.0 through 1.29.1, and 2.0.0 through 2.1.1. Fixed in: 1.30.0 (1.x) or 2.2.0 (2.x). What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/cve-2026-116685-model-context-protocol-python-sdk (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain2d ago

      Am I affected? Affected: mcp 1.8.0 through 1.29.1, and 2.0.0 through 2.1.1. Fixed in: 1.30.0 (1.x) or 2.2.0 (2.x).

      • Check your version: run pip show mcp. Versions >= 2.0.0, < 2.2.0 of mcp are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "mcp>=2.2.0" (first patched version 2.2.0).
      2. Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later; no code changes are needed.
      3. Until you can upgrade, supply your own HTTP client with follow_redirects left at False (http_client= on streamable_http_client; httpx_client_factory= on sse_client and streamablehttp_client; ClientSessionGroup has no such parameter).
      4. If a client may already have followed a redirect to a host you do not control, rotate the credentials it carried.
      5. If your client currently reaches its server through a redirect to another host, including a server that needs no credentials, it will stop connecting after the upgrade: set the endpoint URL to the redirect's target.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-116685-model-context-protocol-python-sdk (opens external site)

      Did this work for you?

    Add your answer or comment