Security Advisory

CVE-2026-59950

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-15 20:08:54

Last updated 2026-07-17 12:28:19

Assigner GitHub_M

CVSS score 7.6

State PUBLISHED

Description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

← Browse all CVEs View on cve.org ↗