CVE-2026-111769: 
JavaScript 脆弱性分析と緩和策

CVE-2026-111769 is an unvalidated cross-origin redirect vulnerability in the Model Context Protocol (MCP) TypeScript SDK that causes HTTP client transports and OAuth requests to leak sensitive credentials to attacker-controlled origins. Affected packages include @modelcontextprotocol/sdk (all versions through 1.31.0) and @modelcontextprotocol/client (versions 2.0.0 through 2.2.0). The vulnerability was published on October 2, 2026, added to the GitHub Advisory Database on October 20, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory).

The root cause is improper handling of HTTP redirects (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor): the SDK's StreamableHTTPClientTransport, SSEClientTransport, and OAuth helper functions (e.g., auth()) delegated all redirect following to the underlying fetch implementation without restricting the target origin. When an MCP server or authorization server issued a redirect to a different origin, the SDK re-sent custom request headers — such as X-API-Key and mcp-session-id — to the redirect target. On 307 or 308 redirects, the full request body was also forwarded, including OAuth token requests containing refresh_token and client_secret values. Note that fetch on current runtimes already drops the Authorization header across origins, but other custom headers and bodies were not protected. stdio clients are not affected (Github Advisory, Fix PR #2901).

Successful exploitation allows a network attacker who controls or can influence an MCP server or authorization server to redirect client requests to an arbitrary origin, receiving API keys, session identifiers, OAuth refresh_token values, and client_secret values. This results in high confidentiality impact (credential theft enabling account takeover or unauthorized API access) and low integrity impact (potential for token misuse). Availability is not directly affected. Applications using HTTP-based MCP transports or OAuth flows are at risk; stdio-based clients are not (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The vulnerability requires an attacker to control or compromise an MCP server or authorization server to issue a malicious redirect, which raises the attack complexity. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available. Reporters credited are dodge1218 and nickelsec (Github Advisory).

1. Control or compromise a redirect target: The attacker sets up or compromises an MCP server, authorization server, or any intermediary capable of issuing HTTP redirects (301, 302, 307, or 308) to an attacker-controlled host.
2. Trigger a client connection: The attacker causes a vulnerable MCP client application (using StreamableHTTPClientTransport, SSEClientTransport, or OAuth helpers like auth()) to connect to the malicious or compromised server.
3. Issue a cross-origin redirect: The server responds with a redirect (e.g., 307 Temporary Redirect or 308 Permanent Redirect) pointing to an attacker-controlled origin.
4. Harvest leaked credentials: Because the SDK follows the redirect without stripping custom headers or the request body, the attacker's server receives the X-API-Key, mcp-session-id, and — on 307/308 — the full OAuth token request body including refresh_token and client_secret.
5. Exploit harvested credentials: The attacker uses the stolen API keys or OAuth tokens to impersonate the victim client, access protected resources, or perform unauthorized actions on behalf of the compromised application (Github Advisory, Fix PR #2901).

• Network: Outbound HTTP/HTTPS requests from MCP client hosts to unexpected or unknown origins immediately following connections to MCP servers; cross-origin redirect responses (307/308) from MCP or authorization servers pointing to external hosts.
• Logs: Application logs showing HTTP redirect chains where the final destination differs in scheme, host, or port from the original MCP server URL; OAuth token requests (POST with refresh_token or client_secret in body) sent to non-configured authorization server endpoints.
• Credential Abuse: Unexpected API key usage or OAuth token activity from IP addresses not associated with the legitimate client application; token refresh activity from unfamiliar geographic locations or user agents.
• Configuration: Presence of redirectPolicy: 'follow' in transport configuration after upgrading, which restores the vulnerable behavior (Github Advisory).

Upgrade to the patched versions: @modelcontextprotocol/sdk 1.32.0 or later (for 1.x users), or @modelcontextprotocol/client 2.3.0 or later (for 2.x users). The fix restricts redirect following to same-origin only (same scheme, host, and port, or HTTP to HTTPS on the same host with default ports), and disables redirect following entirely in browser environments. As an immediate workaround for those unable to upgrade, pass a custom fetch implementation that refuses redirects: (url, init) => fetch(url, { ...init, redirect: 'error' }). If a cross-origin redirect may have already occurred, rotate all API keys and client_secret values and revoke any issued tokens. Do not set redirectPolicy: 'follow' on transports unless the redirect target is fully trusted, as this restores the vulnerable behavior (Github Advisory, Fix PR #2901, Fix PR #2902).

The fix was developed and merged by Felix Weinberger with AI-assisted code review (Claude Code) on September 30, 2026, and the advisory was published to the GitHub Advisory Database on October 20, 2026. A related open issue (#2700) was filed by community member trickyfalcon noting that the same redirect-following class of vulnerability could enable SSRF and protocol confusion, indicating broader community awareness of the redirect handling risk in MCP clients. The Go SDK community also tracked the issue, with a corresponding fix merged in modelcontextprotocol/go-sdk#1429 (Fix PR #2901, Github Advisory).