Mcp Python SDK vulnerabilities

4 known vulnerabilities in Mcp Python SDK from Lfprojects. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  python-sdk: Origin Validation Error

  CVE-2026-59950Jul 15, 2026Modelcontextprotocol

  The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validat

• 7.6 High severity

  python-sdk: Missing Authorization

  CVE-2026-52870Jul 15, 2026Modelcontextprotocol

  The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate

• 7.1 High severity

  python-sdk: Authorization Bypass Through User-Controlled Key

  CVE-2026-52869Jul 15, 2026Modelcontextprotocol

  The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSess

• 8.1 High severity

  python-sdk: Initialization of a Resource with an Insecure Default

  CVE-2025-66416Dec 2, 2025Modelcontextprotocol

  The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an