Tag
#WebSocket
newsHIGH 7.6
MCP Python SDK Vulnerability: WebSocket Server Transport Lacks Host/Origin Validation (CVE-2026-59950)
A vulnerability in the deprecated WebSocket server transport of the MCP Python SDK allows unauthenticated attackers to connect and issue JSON-RPC requests. Affected servers are those that expose `mcp.server.websocket.websocket_server` and lack proper authentication or origin validation. The vulnerability has a CVSS score of 7.6.
articleCRITICAL 9.2
Critical WebSocket Message Corruption Vulnerability in websocket-driver (CVE-2026-54466)
A critical vulnerability (CVE-2026-54466, CVSS 9.2) exists in the websocket-driver library, allowing for message corruption via abuse of protocol length headers. This issue affects versions < 0.7.5 and has been patched in version 0.7.5. Successful exploitation requires no authentication or user interaction and can lead to incorrect parsing of subsequent payloads. Immediate upgrade to version 0.7.5 is recommended.