Read the docs
TI-2026-42756 Aliases CVE-2026-59950GHSA-vj7q-gjh5-988w

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Priority LOW 35CWE-1385Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.

Summary

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 13th percentileScored 2026-11-07
Fix Fixed python-sdk (modelcontextprotocol): 1.28.1mcp (PyPI): 1.28.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowpython-sdkbefore 1.28.11.28.1Patch availableCNA
—mcp (PyPI)before 1.28.11.28.1Patch availableGHSA-vj7q-gjh5-988w
  • python-sdk VendorMLflow Affected before 1.28.1 Fixed in 1.28.1 Patch available CNA
  • mcp (PyPI) Vendor— Affected before 1.28.1 Fixed in 1.28.1 Patch available GHSA-vj7q-gjh5-988w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*before 1.28.1VulnerableMLflow
  • cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:* Versions before 1.28.1 Vulnerable ·MLflow

Remediation

  • Fix · CNA python-sdk (modelcontextprotocol) Fixed in 1.28.1
  • Fix · GHSA-vj7q-gjh5-988w mcp (PyPI) Fixed in 1.28.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59950
  2. 2026-10-03 Alias added: GHSA-vj7q-gjh5-988w

References

Patch 2

Advisory 2

Other 2

  • TI-2025-40852 DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost CVSS 4.0HIGH 7.6
  • TI-2026-37970 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal CVSS 3.1HIGH 7.1
  • TI-2026-37971 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences