The official source reports this update: v1.107.8 (2026-10-19). This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56 . Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False . URL-based MCP capabilities could also expose a credential embedded in the URL-derived identifier. Fixed in v2.58.0 and v1.107.8. Restrict access to historical traces and rotate exposed credentials. Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows.
Canonical AI event
v1.107.8 restricts access to historical traces and rotates exposed credentials.
The v1.107.8 update fixes a medium security issue in MCP request telemetry. Historical trace access is now restricted.
21 Oct 20261 verified claims1 sources1 observations
This official update documents a development concerning v1.107.8 (2026-10-19). Its practical significance depends on the scope and evidence stated by the source.
Read the official source update and verify its stated scope, evidence and timing before acting on it.
Connected knowledge
Entities affected by this event
Continue this topic
Related verified updates
Evidence trail
Sources behind the event
Editorial presentation
Open story