MCP Python SDK Vulnerability: WebSocket Server Transport Lacks Host/Origin Validation (CVE-2026-59950)

Executive Summary

A vulnerability in the MCP Python SDK's deprecated WebSocket server transport allows attackers to bypass Host/Origin validation, potentially leading to unauthorized access and JSON-RPC requests. This affects servers using `mcp.server.websocket.websocket_server` without additional security measures. The vulnerability has a CVSS score of 7.6.

Technical Analysis

The vulnerability is classified as a Improper Access Control issue. The `websocket_server()` function in the MCP Python SDK constructs a Starlette `WebSocket` and calls `accept(subprotocol="mcp")` immediately, without inspecting the connection's headers. This allows any origin to open a WebSocket connection to a reachable MCP server on this transport, complete the `initialize` handshake, and issue JSON-RPC requests.

How It Gets Exploited

An attacker can exploit this vulnerability by having a user who runs an MCP server on this transport bound to localhost or a LAN address visit a malicious web page. The web page can then open a WebSocket connection to the MCP server, complete the `initialize` handshake, and issue JSON-RPC requests. This can lead to enumeration and invocation of the server's tools and reading of its resources. The consequences depend on what the server exposes.

Impact Assessment

The impact of this vulnerability is significant, with a CVSS score of 7.6. Affected products are those using the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`). Servers using stdio, SSE, or Streamable HTTP are not affected. An attacker can achieve unauthorized access and potentially issue JSON-RPC requests.

Recommended Actions

To mitigate this vulnerability, upgrade to version 1.28.1 or later of the MCP Python SDK. In this version, `websocket_server()` accepts an optional `security_settings: TransportSecuritySettings` argument, which validates the `Host` and `Origin` headers before accepting the handshake. To enable protection, pass a `TransportSecuritySettings` with `enable_dns_rebinding_protection=True` and appropriate `allowed_hosts` / `allowed_origins`. The recommended path is to migrate off this deprecated transport to Streamable HTTP, where `FastMCP` enables this protection automatically for localhost binds.

Sources

- GitHub Security Advisories: GHSA-vj7q-gjh5-988w - CVE: CVE-2026-59950