Threats tagged 'brew-mistral-vibe-cve-2026-59950'

The MCP Python SDK's deprecated WebSocket server transport does not validate Host or Origin headers during the WebSocket handshake, allowing any web page to connect and issue JSON-RPC requests if the server is exposed. This can lead to unauthorized access to server tools and resources if no additional authentication or origin checks are in place. The vulnerability affects versions from 1.1.1 up to but not including 2.18.3. The issue is fixed in version 2.18.3 by adding optional security settings for header validation. The recommended mitigation is to upgrade and configure these settings or migrate to the Streamable HTTP transport, which enforces such protections automatically. The WebSocket transport is removed entirely in version 2.