- Yama var
- Son 7 gün
- CWE-200
CVE-2026-111769
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
@modelcontextprotocol client@modelcontextprotocol sdkmodelcontextprotocol typescript-sdk
- Yayımlandı
- Güncellendi
- 6 Kas 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0.
Etkilenen sürümler3 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| @modelcontextprotocol client | Sürüm belirtilmemiş | – |
| @modelcontextprotocol sdk | < 1.32.0 | 1.32.0 |
| modelcontextprotocol typescript-sdk | < 1.32.0 | 1.32.0 |
Kaynaklar9 kaynak
- CVE.org kaydı
- NVD kaydı
- github.com/…pt-sdk/security/advisories/GHSA-6prh-2h8m-c8cw Diğer
- github.com/modelcontextprotocol/typescript-sdk/pull/2901 Diğer
- github.com/modelcontextprotocol/typescript-sdk/pull/2902 Diğer
- github.com/…ommit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d Diğer
- github.com/…ommit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0 Diğer
- github.com/…extprotocol/typescript-sdk/releases/tag/1.32.0 Diğer
- github.com/…eleases/tag/@modelcontextprotocol/server@2.3.0 Diğer
Kayıt geçmişi
- Yayımlandı