CVE-2026-59950

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266	Patch
https://github.com/modelcontextprotocol/python-sdk/pull/2992	Issue Tracking Patch
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1	Release Notes
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El SDK de Python de MCP, llamado mcp en PyPI, es una implementación en Python del Protocolo de Contexto de Modelo (MCP). Antes de la versión 1.28.1, el transporte obsoleto mcp.server.websocket.websocket_server aceptaba handshakes de WebSocket sin aplicar la validación de encabezados Host u Origin, dejando ninguna forma a nivel de SDK de restringir qué orígenes podían conectarse a las aplicaciones que exponían ese transporte. Este problema está solucionado en la versión 1.28.1.

Information

Published : 2026-07-15 21:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59950

Mitre link : CVE-2026-59950

CVE.ORG link : CVE-2026-59950

JSON object : View

Products Affected

lfprojects

mcp_python_sdk

CWE

CWE-346

Origin Validation Error

CWE-1385

Missing Origin Validation in WebSockets

{"id": "CVE-2026-59950", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59950", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T12:28:09.718600Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "modelcontextprotocol", "product": "python-sdk", "versions": [{"status": "affected", "version": "< 1.28.1"}]}]}], "published": "2026-07-15T21:16:55.683", "references": [{"url": "https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/python-sdk/pull/2992", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-1385"}]}], "descriptions": [{"lang": "en", "value": "The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1."}, {"lang": "es", "value": "El SDK de Python de MCP, llamado mcp en PyPI, es una implementaci\u00f3n en Python del Protocolo de Contexto de Modelo (MCP). Antes de la versi\u00f3n 1.28.1, el transporte obsoleto mcp.server.websocket.websocket_server aceptaba handshakes de WebSocket sin aplicar la validaci\u00f3n de encabezados Host u Origin, dejando ninguna forma a nivel de SDK de restringir qu\u00e9 or\u00edgenes pod\u00edan conectarse a las aplicaciones que expon\u00edan ese transporte. Este problema est\u00e1 solucionado en la versi\u00f3n 1.28.1."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0A716F9-2B03-4AA1-8033-397778EF3981", "versionEndExcluding": "1.28.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}