CVE-2026-59950: MCP Python SDK · WebSocket server transport does not support Host/Origin validation
Affects snyk-agent-scanSource GCVE Database
Not known to be exploited · CVSS 7.6 High : upgrade to 0.5.17 soon.
Data as of 26 Oct 2026, 09:16 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.5.17
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NExploitation evidence
Disclosed: evidence found.
CVE published 15 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade snyk-agent-scan to 0.5.17.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewsnyk-agent-scanpkg:brew/snyk-agent-scanOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to MCP Python SDK version 1.28.1 or later, which adds optional Host and Origin header validation to the deprecated WebSocket transport. To enable protection, pass a TransportSecuritySettings object with enable_dns_rebinding_protection set to true and configure allowed_hosts and allowed_origins appropriately. Simply upgrading without enabling validation does not mitigate the issue. The recommended mitigation is to migrate off the deprecated WebSocket transport to the Streamable HTTP transport, where FastMCP automatically enforces these security checks. Note that the WebSocket transport is removed entirely in version 2, so migration is advised.
Description
The MCP Python SDK's deprecated WebSocket server transport does not validate Host or Origin headers during the WebSocket handshake, allowing any web page to connect and issue JSON-RPC requests if the server is exposed without additional protections. This affects applications that explicitly use the deprecated websocket_server transport, which is not part of the MCP specification and must be manually integrated. The vulnerability can lead to unauthorized enumeration and invocation of server tools and resource access depending on the server's exposure. The issue is fixed in version 1.28.1 by adding optional Host and Origin validation, but upgrading alone does not enable validation unless configured. The recommended mitigation is to migrate away from the deprecated transport to Streamable HTTP, which enforces these protections automatically. The WebSocket transport is removed entirely in version 2.
References
- github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w (opens in a new tab)
- nvd.nist.gov/vuln/detail/CVE-2026-59950 (opens in a new tab)
- github.com/modelcontextprotocol/python-sdk/pull/2992 (opens in a new tab)
- github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266 (opens in a new tab)
- github.com/modelcontextprotocol/python-sdk (opens in a new tab)
- github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1 (opens in a new tab)