CVE-2026-44429 is a stored cross-site scripting (XSS) vulnerability in the modelcontextprotocol (MCP) registry versions prior to 1.7.7. The vulnerability arises from improper neutralization of input in the server.websiteUrl field, which is included in the public catalogue UI without sufficient escaping. This allows an attacker with publish access to inject malicious event handlers into the registry homepage. The vulnerability is medium severity with a CVSS 5.1 score and is fixed in version 1.7.7.
CVE-2026-44430 is a Server-Side Request Forgery (SSRF) vulnerability in the modelcontextprotocol (MCP) registry versions prior to 1.7.7. The vulnerability arises because the registry's HTTP-based namespace verification uses a blocklist that does not cover certain IPv6 address ranges (6to4, NAT64, and deprecated site-local), which can encode arbitrary IPv4 addresses. This allows an attacker to bypass restrictions intended to prevent dialing private or internal addresses, potentially enabling SSRF attacks. The issue is fixed in version 1.7.7.
CVE-2026-45781 is a vulnerability in the modelcontextprotocol (MCP) registry prior to version 1.7.9. The issue arises because the OCI ownership validation fails open when the upstream OCI registry returns an HTTP 429 (Too Many Requests) response. This failure allows any authenticated publisher to bind namespaces they do not control to OCI images, bypassing the critical label-match ownership check. The vulnerability is specific to OCI packages; other package types enforce stricter validation. This flaw has a low severity score and no known exploits in the wild. A fix was introduced in version 1.7.9.
CVE-2026-42559 is a high-severity vulnerability in the modelcontextprotocol Rust SDK (rmcp crate) prior to version 1.4.0. The Streamable HTTP server transport did not validate the incoming Host header, enabling a DNS rebinding attack. This flaw could allow a malicious website to send authenticated requests to an MCP server running on a victim's loopback or private network interface. The vulnerability is fixed in version 1.4.0. No known exploits in the wild have been reported.
CVE-2026-35568 is a high-severity vulnerability in the Model Context Protocol (MCP) Java SDK versions prior to 1.0.0. It is a DNS rebinding vulnerability that allows an attacker to access a locally or network-private MCP server through a victim's browser that is local or network adjacent. This enables the attacker to perform any tool call to the MCP server as if they were a locally running MCP-connected AI agent. The vulnerability is fixed in version 1.0.0 of the java-sdk.
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without validating the `Origin` header and without requiring `Content-Type: application/json`. In deployments without Authorization, especially stateless or sessionless configurations, this allows an arbitrary website to send MCP requests to a local server and potentially trigger tool execution. Version 1.4.1 contains a patch for the issue.
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. Because the tool used GitPython's repo.index.add() rather than the Git CLI, relative paths containing `../` sequences that resolve outside the repository were accepted and staged into the Git index. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless StreamableHTTPServerTransport deployments. This issue has been patched in version 1.26.0.
In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.17 upon release to remediate this issue.
In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line options rather than git refs, enabling arbitrary file overwrites. The fix adds validation that rejects arguments starting with - and verifies the argument resolves to a valid git ref via rev_parse before execution. Users are advised to update to 2025.12.17 resolve this issue when it is released.
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible to the server process, making those directories eligible for subsequent git operations. The tool was removed entirely, as the server is intended to operate on existing repositories only. Users are advised to upgrade to 2025.9.25 or newer to remediate this issue.
### Description
The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport.
Servers created via `FastMCP()` now have DNS rebinding protection enabled by default when the `host` parameter is `127.0.0.1` or `localhost`. Users are advised to update to version `1.23.0` to receive this automatic protection. Users with custom low-level server configurations using `StreamableHTTPSessionManager` or `SseServerTransport` directly should explicitly configure `TransportSecuritySettings` when running an unauthenticated server on localhost.
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.24.0.
CVE-2025-58444 is a high-severity cross-site scripting (XSS) vulnerability in the modelcontextprotocol (MCP) Inspector local development tool. The flaw occurs when the Inspector renders a redirect URL from a remote MCP server without proper neutralization of encoded URI schemes. Connecting to an untrusted server can allow crafted redirects to inject scripts into the Inspector context, potentially leading to arbitrary command execution on the developer's machine. Version 0.16.6 of the Inspector includes hardened URL handling and validation that prevents this script execution.
CVE-2025-53366 is a high-severity vulnerability in the Model Context Protocol (MCP) Python SDK prior to version 1.9.4. It causes an unhandled exception when processing malformed requests, resulting in HTTP 500 errors and service unavailability until manual restart. The issue is fixed in version 1.9.4.
CVE-2025-53365 is a high-severity vulnerability in the Model Context Protocol (MCP) Python SDK before version 1.10.0. It involves an uncaught ClosedResourceError exception on the server side triggered by a client after establishing a streamable HTTP session, which can cause the server to crash and require a restart. The issue is fixed in version 1.10.0.