MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.
Summary
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | python-sdk | before 1.9.4 | 1.9.4 | Patch available | CNA |
| — | mcp (PyPI) | before 1.9.4 | 1.9.4 | Patch available | GHSA-3qhf-m339-9g5v |
- python-sdk VendorMLflow Affected before 1.9.4 Fixed in 1.9.4 Patch available CNA
- mcp (PyPI) Vendor— Affected before 1.9.4 Fixed in 1.9.4 Patch available GHSA-3qhf-m339-9g5v
Remediation
- Fix · CNA python-sdk (modelcontextprotocol) Fixed in 1.9.4
- Fix · GHSA-3qhf-m339-9g5v mcp (PyPI) Fixed in 1.9.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Lightspeed | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53366
- 2026-10-03 Alias added: GHSA-3qhf-m339-9g5v
- 2026-10-05 EPSS moved to the 95th–99th percentile
References
Advisory 2
Other 7
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v
- https://github.com/modelcontextprotocol/python-sdk/pull/822
- https://github.com/modelcontextprotocol/python-sdk/commit/29c69e6a47d0104d0afcea6ac35e7ab02fde809a
- https://github.com/modelcontextprotocol/python-sdk
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.9.4
- https://github.com/pypa/advisory-database/tree/main/vulns/mcp/PYSEC-2026-1616.yaml
- https://pypi.org/project/mcp
More MLflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
- TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
Sources
- CVE-2025-53366 · CVE Program
- CVE-2025-53366 · NVD
- FIRST EPSS
- GHSA-3qhf-m339-9g5v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-53366 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences