The official source reports this update: v2.58.0 (2026-10-19). This comment was posted by codex-tui using gpt-6.1-sol on behalf of David. What's Changed 🛡️ Security Medium — MCP request telemetry: GHSA-xv4x-g8mx-ch56 . Provider-native MCP configuration could expose server URLs, authorization tokens and custom header values in OpenTelemetry request traces, even with include_content=False . URL-based MCP capabilities could also expose a credential embedded in the URL-derived identifier. Fixed in v2.58.0 and v1.107.8. Restrict access to historical traces and rotate exposed credentials. Temporal mitigation: URL-based MCP activity names remain unchanged to preserve in-flight workflows.
Canonical AI event
v2.58.0 restricts access to historical traces and rotates exposed credentials.
v2.58.0 restricts access to historical traces and rotates exposed credentials.
21 Oct 20261 verified claims1 sources2 observations
This official update documents a development concerning v2.58.0 (2026-10-19). Its practical significance depends on the scope and evidence stated by the source.
Read the official source update and verify its stated scope, evidence and timing before acting on it.
Connected knowledge
Entities affected by this event
Continue this topic
Related verified updates
Evidence trail
Sources behind the event
Editorial presentation
Open story