modelcontextprotocol vulnerabilities

Products

• python-sdk 11
• @modelcontextprotocol/sdk 9
• typescript-sdk 8
• ruby-sdk 6
• servers 6
• registry 5
• go-sdk 4
• rust-sdk 4
• server 4
• @modelcontextprotocol/inspector 3
• @modelcontextprotocol/server-filesystem 2
• client 2
• java-sdk 2
• @modelcontextprotocol/hono 1
• @modelcontextprotocol/node 1
• express 1
• io.modelcontextprotocol:kotlin-sdk 1
• io.modelcontextprotocol:kotlin-sdk-client 1
• io.modelcontextprotocol:kotlin-sdk-core 1
• io.modelcontextprotocol:kotlin-sdk-server 1
• io.modelcontextprotocol.sdk:mcp 1
• io.modelcontextprotocol.sdk:mcp-core 1
• mcp-server-everything 1
• mcp-server-fetch 1
• php-sdk 1
• server-legacy 1

Latest modelcontextprotocol CVEs

Newest publication first · page 2 of 3

1. CVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validation

   Published 2026-07-15

   High·CVSS 7.6 EPSS 0.23%

   The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-...

2. CVE-2026-52870 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

   Published 2026-07-15

   High·CVSS 7.6 EPSS 0.39%

   The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identi...

3. CVE-2026-52869 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

   Published 2026-07-15

   High·CVSS 7.1 EPSS 0.53%

   The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route req...

4. CVE-2026-44428 MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience

   Published 2026-05-14

   Low·CVSS 2.1 EPSS 0.22%

   The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client sid...

5. CVE-2026-44427 MCP Registry: Open Redirect

   Published 2026-05-14

   None·CVSS 0.0 EPSS 0.47%

   The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g...

6. CVE-2026-44429 MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

   Published 2026-05-14

   Medium·CVSS 5.1 EPSS 0.17%

   The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field...

7. CVE-2026-44430 MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist

   Published 2026-05-14

   Medium·CVSS 6.3 EPSS 0.29%

   The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to...

8. CVE-2026-45781 MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims

   Published 2026-05-14

   Low·CVSS 3.5 EPSS 0.23%

   The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* nam...

9. CVE-2026-42559 RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

   Published 2026-05-14

   High·CVSS 8.8 EPSS 0.27%

   RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS...

10. CVE-2026-35568 MCP Java-SDK has a DNS Rebinding Vulnerability

    Published 2026-04-07

    High·CVSS 7.6 EPSS 0.16%

    MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that i...

11. CVE-2026-34742 Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

    Published 2026-04-02

    High·CVSS 7.6 EPSS 0.47%

    The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTT...

12. CVE-2026-34237 MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)

    Published 2026-03-31

    Medium·CVSS 6.1 EPSS 0.23%

    MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.

13. CVE-2026-33946 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

    Published 2026-03-27

    High·CVSS 8.2 EPSS 0.47% PoC

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack th...

14. CVE-2026-33252 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion

    Published 2026-03-23

    Medium·CVSS 6.5 EPSS 0.19%

    The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site POST requests without validating the Origin header and without requiring Content-Type: application/json. In deployments without Au...

15. GHSA-q382-vc8q-7jhj Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

    Published 2026-03-19

    High·CVSS 8.2

    The Go SDK recently transitioned to the segmentio/encoding library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with null Unicode characters ap...

16. CVE-2026-27896 MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

    Published 2026-02-26

    High·CVSS 7.0 EPSS 0.29%

    The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method",...

17. CVE-2026-27735 mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries

    Published 2026-02-25

    Medium·CVSS 6.4 EPSS 0.35%

    Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries....

18. CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

    Published 2026-02-04

    High·CVSS 7.1 EPSS 0.29%

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in st...

19. CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

    Published 2026-01-05

    High·CVSS 8.7 EPSS 0.44%

    Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching...

20. CVE-2025-68145 mcp-server-git has missing path validation when using --repository flag

    Published 2025-12-17

    Medium·CVSS 6.4 EPSS 7.0%

    In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could...

21. CVE-2025-68144 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

    Published 2025-12-17

    Medium·CVSS 6.3 EPSS 7.2%

    In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., --output=/path/to/file for git_diff) would be interpreted as command-line options ra...

22. CVE-2025-68143 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

    Published 2025-12-17

    Medium·CVSS 6.5 EPSS 8.1%

    Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target locati...

23. CVE-2025-66416 DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost

    Published 2025-12-02

    High·CVSS 7.6 EPSS 0.54%

    The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server...

24. CVE-2025-66414 DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

    Published 2025-12-02

    High·CVSS 7.6 EPSS 0.54%

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on l...

25. CVE-2025-58444 MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

    Published 2025-09-08

    High·CVSS 8.6 EPSS 0.71%

    The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.