Which versions of MCP Python SDK are affected by CVE-2026-59950?

The Model Context Protocol (mcp) Python SDK contains a cross-origin WebSocket hijacking vulnerability affecting versions before 1.28.1; malicious websites can hijack MCP sessions and execute…. A patch is available.

How to fix or mitigate CVE-2026-59950?

Within 24 hours, inventory all systems running mcp Python SDK, identify instances running versions before 1.28.1 using the deprecated mcp.server.websocket.websocket_server transport, and assess network exposure and business criticality. Within 7 days, validate upgrade to mcp version 1.28.1 or later in a staging environment and prepare rollout plan for each affected application. Within 30 days, complete upgrade of all mcp installations to version 1.28.1 or later across development, staging, and production environments.

MCP Python SDK CVE-2026-59950

Q: What is the CVSS score of CVE-2026-59950?

CVE-2026-59950 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44798 HIGH

Origin Validation Error (CWE-346)

2026-07-15 GitHub_M

GHSA-vj7q-gjh5-988w

Python Information Disclosure Python Sdk Modelcontextprotocol

7.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable and unauthenticated (PR:N), but AC:H and UI:R reflect the required cross-origin/DNS-rebinding setup and a victim loading attacker content; high C/I on hijacked MCP tools, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 21:01 vuln.today

Analysis Generated

Jul 15, 2026 - 21:01 vuln.today

CVE Published

Jul 15, 2026 - 20:08 cve.org

HIGH 7.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

440 pypi packages depend on mcp (108 direct, 334 indirect)

Ecosystem-wide dependent count for version 1.28.1.

DescriptionCVE.org

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

Articles & Coverage 1

News 7 New Python Vulnerabilities - 7 High Severity, No Public POC Jul 16, 2026

AnalysisAI

Cross-origin WebSocket hijacking in the Model Context Protocol Python SDK (mcp on PyPI) before 1.28.1 lets a remote web page connect to any application exposing the deprecated mcp.server.websocket.websocket_server transport, because that transport accepted handshakes without Host or Origin validation and offered no SDK-level control to restrict connecting origins. A malicious site loaded in a victim's browser can therefore open an MCP session against a locally reachable server and drive its tools. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the tags flag it as information disclosure.

Technical ContextAI

The Model Context Protocol (MCP) is a JSON-RPC-based standard for connecting LLM clients to tool/resource servers, and the mcp package is its reference Python implementation offering several server transports (Streamable HTTP, SSE, and the now-deprecated raw WebSocket transport). The SSE and Streamable HTTP transports route requests through TransportSecurityMiddleware (TransportSecuritySettings with allowed_hosts/allowed_origins and DNS-rebinding protection), but websocket_server bypassed this layer entirely. The root cause is CWE-346 (Origin Validation Error): the WebSocket handshake was accepted regardless of the Host or Origin header, so a browser on any origin could establish a session. The PR #2992 fix threads a security_settings parameter into websocket_server and calls security.validate_request(...) before accepting the handshake, rejecting mismatched Host/Origin with an HTTP 403 pre-accept close. The affected component is cpe:2.3:a:modelcontextprotocol:python-sdk:*.

RemediationAI

Vendor-released patch: 1.28.1 - upgrade the mcp PyPI package to 1.28.1 or later (pip install --upgrade 'mcp>=1.28.1'). After upgrading, explicitly pass security_settings to websocket_server using TransportSecuritySettings(enable_dns_rebinding_protection=True, allowed_hosts=[...], allowed_origins=[...]) so Host/Origin validation is actually enforced, since the default still accepts any origin to preserve backward compatibility (as the added test test_ws_security_default_settings confirms). If you cannot upgrade immediately, the strongest compensating control is to stop using the deprecated WebSocket transport and migrate to the Streamable HTTP or SSE transports, which already support TransportSecurityMiddleware; alternatively, place a reverse proxy in front of the endpoint that rejects WebSocket handshakes whose Origin is not in an allowlist and validates the Host header (trade-off: adds proxy configuration and can break legitimate clients if the allowlist is too narrow), and bind the server strictly to loopback with host firewall rules to limit reachability (trade-off: prevents intended remote clients). See the fix in PR #2992 (https://github.com/modelcontextprotocol/python-sdk/pull/2992) and commit 777b8d06710c140e3606b0d4598e2aa48546c266.