Skip to content
OpenAdvisories

Package · PyPI

mcp

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-59950

    MCP Python SDK: WebSocket server transport does not support Host/Origin validation

    The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header valida…

    Model Context Protocol python-sdk semgrep mcp Wolfi PyPI
  • High 7.6
    CVE-2026-52870

    MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

    The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operat…

    Model Context Protocol python-sdk semgrep mcp Wolfi PyPI
  • High 7.1
    CVE-2026-52869

    MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

    The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSes…

    Model Context Protocol python-sdk semgrep mcp Wolfi PyPI
  • High 7.6
    CVE-2025-66416

    DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an…

    Model Context Protocol python-sdk semgrep open-webui-compat Wolfi PyPI
  • High 8.7
    CVE-2025-53366

    MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unava…

    Model Context Protocol python-sdk mcp PyPI
  • High 8.7
    CVE-2025-53365

    MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service

    The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught Closed…

    Model Context Protocol python-sdk mcp PyPI