Vulnerabilities

TI-2026-42756 CVE-2026-59950 · GHSA-vj7q-gjh5-988w

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

LOW 35

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00231 Published 2026-07-15 Fixed in 1.28.1 CWE-1385

TI-2026-37971 CVE-2026-52870 · GHSA-hvrp-rf83-w775

LOW 33

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00388 Published 2026-07-15 Fixed in 1.27.2 CWE-862

TI-2026-37970 CVE-2026-52869 · GHSA-jpw9-pfvf-9f58

LOW 34

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00535 Published 2026-07-15 Fixed in 1.27.2 CWE-639

TI-2025-40852 CVE-2025-66416 · GHSA-9h52-p55h-vw2f

LOW 36

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP).

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00544 Published 2025-12-02 Partial fix · 1.23.0 CWE-1188