Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-59950

CVE-2026-59950 (CVSS 7.6) affects the MCP Python SDK's deprecated mcp.server.websocket.websocket_server transport, which accepted WebSocket handshakes without validating Host or Origin headers, giving no SDK-level way to restrict which origins could connect to applications exposing that transport. This is a classic CSWSH-style origin-validation flaw (CWE-346, CWE-1385) fixed in mcp 1.28.1.

TL;DR MCP Python SDK's deprecated WebSocket transport lacked Host/Origin validation, enabling cross-site WebSocket connections; fixed in 1.28.1.
Open original ↗
Document

What it is

CVE-2026-59950 (published 2026-07-15, Analyzed) in the MCP Python SDK (mcp on PyPI, LF Projects). The deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without Host or Origin validation. Fixed in 1.28.1.

How it works

The mechanism is fully in the summary: a CSWSH-style origin-validation gap (CWE-346, CWE-1385), no SDK-level way to restrict connecting origins. What the summary omits is the CVSS 4.0 vector, which changes how urgently you should treat it:

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N

  • AT:P — attack requirements are present; exploitation is not unconditional.
  • UI:P — user interaction (passive) is required. Consistent with CSWSH: a victim must be induced to load attacker-controlled content that then rides their browser to the exposed transport.
  • PR:N — no privileges needed by the attacker.
  • Impact is confidentiality- and integrity-high, availability-none (VC:H/VI:H/VA:N).

So the 7.6 HIGH is gated on luring a user, not a straight unauthenticated network hit — relevant if you're prioritizing.

Preconditions / Affected

mcp prior to 1.28.1, and an application that actually exposes the deprecated websocket_server transport. Applications not using that transport are not in scope.

What to do

Upgrade to mcp 1.28.1. The fix and its provenance:

  • Commit 777b8d06710c140e3606b0d4598e2aa48546c266
  • PR #2992
  • Advisory GHSA-vj7q-gjh5-988w
  • Release tag v1.28.1

The transport is deprecated; if you can move off websocket_server entirely rather than only patching, that removes the exposure at the source.

Organisations named here

  • GHSA-vj7q-gjh5-988w

CVEs named here

  • CVE-2026-59950

Technologies named here

  • lfprojects mcp python sdk
  • mcp.server.websocket.websocket_server
  • Model Context Protocol
  • Python

Techniques named here

  • CWE-1385
  • Origin Validation Error
  • Missing Origin Validation in WebSockets

Related in AppSec