CVE-2026-59950 mcp python sdk vulnerability
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.
Browse Python security risksQuick answer
lfprojects mcp python sdk should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- < 1.28.1
Fixed versions
- 1.28.1
How to fix it
MCP Python SDK (PyPI mcp) is affected by CVE-2026-59950, a missing Host and Origin validation check in the deprecated WebSocket server transport. A malicious web page can connect to a reachable unguarded MCP WebSocket server and invoke its tools or read its resources. Upgrade mcp to 1.28.1 or later, then pass TransportSecuritySettings with DNS rebinding protection and strict allowed_hosts and allowed_origins; upgrading alone does not enable these checks. Prioritize internet-facing and shared production systems first.
- Inventory every MCP Python SDK (PyPI mcp) deployment, version, exposed endpoint, environment, and owner.
- Confirm whether the application manually exposes mcp.server.websocket.websocket_server; FastMCP, stdio, SSE, and Streamable HTTP are not affected by this CVE.
- Upgrade mcp to 1.28.1 or later, then pass TransportSecuritySettings with DNS rebinding protection and strict allowed_hosts and allowed_origins; upgrading alone does not enable these checks.
- Prefer migrating off the deprecated WebSocket transport to Streamable HTTP; MCP Python SDK v2 removes the legacy transport.
- Review WebSocket access logs for unknown origins, unexpected initialize calls, and tool or resource requests from browser clients.
- Rotate credentials and inspect downstream systems if an untrusted WebSocket client may have invoked sensitive tools or read protected resources.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm mcp is 1.28.1 or later and the legacy WebSocket server either has strict TransportSecuritySettings enabled or has been removed in favor of Streamable HTTP.
- Confirm allowed Host and Origin values connect, while a disallowed Host or Origin is rejected with HTTP 403 before the WebSocket handshake.
- Confirm only intended clients and authenticated principals can reach the affected MCP transport, task, or session feature.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-59950.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-59950?
lfprojects mcp python sdk versions listed as affected should be reviewed: < 1.28.1.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.