CVE-2026-59950highCWE-1385CWE-346

CVE-2026-59950: falha de alta gravidade em modelcontextprotocol python-sdk

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar python-sdk+ Monitorar mcp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.2%
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
modelcontextprotocol · python-sdk
CVEs relacionadas — modelcontextprotocol python-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 9.8%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2025-66416HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-52869HIGHMCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalEPSS 0.5%CVE-2026-59951MEDIUMMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionEPSS 0.5%CVE-2025-53365HIGHMCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of ServiceEPSS 0.4%