CVE-2026-104850

A flaw was found in the Model Context Protocol (MCP) TypeScript SDK. A malicious or compromised MCP server can trigger an information disclosure vulnerability by specifying an arbitrary authorization server in its metadata. Because the client implementation fails to bind stored credentials to their designated authorization server, connecting to an untrusted server causes the client to forward sensitive OAuth tokens and secrets without user interaction.

Red Hat rates this vulnerability as an Important severity because it allows a malicious endpoint to silently extract sensitive authentication secrets and tokens over the network without requiring user interaction. The exposure specifically affects environments where Model Context Protocol client components establish HTTP connections to untrusted external servers while configured with OAuth authentication providers. Workloads communicating exclusively over local standard input/output channels or connecting only to verified, trustworthy endpoints are not susceptible to credential exfiltration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.