CVE-2026-59950

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.28.1

Description The MCP Python SDK, a Python implementation of the Model Context Protocol, contains an issue in the deprecated mcp.server.websocket.websocket server transport. This component accepts WebSocket handshakes without validating the Host or Origin headers, which prevents the SDK from restricting which origins can connect to applications using this transport.

Recommendations Update to version 1.28.1. As a temporary mitigation, restrict the use of the mcp.server.websocket.websocket server transport.