Threat Intelligence Database

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

A missing authorization vulnerability exists in the MCP Python SDK (modelcontextprotocol) versions from 1.23.0 up to but not including 1.27.2. Default handlers for task operations do not associate tasks with the creating session, allowing any connected client to enumerate, read, consume, or cancel tasks belonging to other clients. This issue is fixed in version 1.27.2.

CVE-2026-52869 is a high-severity authorization bypass vulnerability in the modelcontextprotocol Python SDK (mcp). Versions prior to 1.27.2 allow an attacker with a known session ID and bearer token to inject JSON-RPC messages into sessions they did not create. This occurs because the SDK routes requests based solely on session identifiers without verifying the authenticated principal. The issue is fixed in version 1.27.2.

CVE-2026-7211 is a command injection vulnerability in dvladimirov MCP version 0.1.0, specifically in the GitSearchRequest function of the mcp_server.py file within the Git Search API component. An attacker can remotely manipulate the repo_url or pattern argument to execute arbitrary commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Although the issue was reported early, the project has not yet responded or provided a fix. Exploit code is publicly available, but no known exploits in the wild have been reported to date.

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.

HighVulnerabilityGermanyFranceUnited Kingdom+7#cve#cve-2025-66416#cwe-1188

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-53366#cwe-248

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.

HighVulnerabilityGermanyFranceUnited Kingdom+6#cve#cve-2025-53365#cwe-248