CVE-2026-111769 | modelcontextprotocol StreamableHTTPClientTransport/SSEClientTransport auth redirectPolicy cross-domain policy

October 20, 2026 Yanac

A vulnerability categorized as problematic has been discovered in modelcontextprotocol. Impacted is the function auth of the component StreamableHTTPClientTransport/SSEClientTransport. Such manipulation of the argument redirectPolicy leads to permissive cross-domain policy with untrusted domains.

This vulnerability is uniquely identified as CVE-2026-111769. The attack can be launched remotely. No exploit exists.VulDB Recent EntriesRead More