Tag

#MCP Python SDK

articleHIGH 7.6

MCP Python SDK Vulnerability: Experimental Task Handlers Allow Unauthorized Access to Tasks

A high-severity vulnerability (CVE-2026-52870) exists in the MCP Python SDK, specifically in the experimental tasks feature. When enabled, default request handlers do not check session ownership, allowing any client to access and cancel other clients' tasks. Affected versions are from 1.23.0 to 1.27.1. The vulnerability has a CVSS v3 score of 7.6 and is classified under CWE-862 (Missing Authorization).

1 source
newsHIGH 7.6

MCP Python SDK Vulnerability: WebSocket Server Transport Lacks Host/Origin Validation (CVE-2026-59950)

A vulnerability in the deprecated WebSocket server transport of the MCP Python SDK allows unauthenticated attackers to connect and issue JSON-RPC requests. Affected servers are those that expose `mcp.server.websocket.websocket_server` and lack proper authentication or origin validation. The vulnerability has a CVSS score of 7.6.

1 source