CVE-2026-59950: modelcontextprotocol python-sdk missing origin validation in WebSocket transport

CVE-2026-59950 · Severity: high · CVSS 4 · Published 2026-07-15

The Model Context Protocol (MCP) Python SDK contains a security flaw in its WebSocket server component. If a developer uses this specific component to host a server, a malicious website visited by a user could bypass standard browser protections to interact with that server. This could allow an attacker to access private data or execute commands on the user's local network or machine, depending on what the server is configured to do.

Technologies: Anthropic Model Context Protocol, Model Context Protocol MCP Python SDK, mcp (PyPI). Vendors: Anthropic, Model Context Protocol, PyPI.

Quick answers

Is CVE-2026-59950 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59950 being exploited in the wild.
How severe is CVE-2026-59950?
High severity, with a CVSS score of 4, published 15 July 2026.
Which products and versions are affected?
Anthropic Model Context Protocol < 1.28.1; Model Context Protocol MCP Python SDK < 1.28.1; mcp (PyPI) ECOSYSTEM:introduced=0,fixed=1.28.1.
Is there a fix for CVE-2026-59950?
Yes. mcp (PyPI): upgrade to 1.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59950 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59950?
Check whether you run Anthropic Model Context Protocol, Model Context Protocol MCP Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp (PyPI): upgrade to 1.28.1 or later
    pip install "mcp>=1.28.1"

Technical details

A vulnerability exists in the deprecated `mcp.server.websocket.websocket_server` transport where it fails to implement `Host` or `Origin` header validation during the WebSocket handshake. While browsers enforce Same-Origin Policy (SOP) for standard web requests, they do not enforce it for WebSocket connections, relying instead on the server to validate the `Origin` header. An attacker can leverage this by hosting a malicious webpage that, when visited by a user, initiates a WebSocket connection to an MCP server running on the user's localhost or LAN. Once connected, the attacker can perform JSON-RPC calls to enumerate tools and read resources. The issue is fixed in version 1.28.1 by integrating `TransportSecuritySettings` into the WebSocket transport, though it must be explicitly enabled.

Affected products

  • Model Context Protocol (MCP) mcp < 1.28.1

Identifiers

  • CVE-2026-59950
  • GHSA-vj7q-gjh5-988w
  • PYSEC-2026-3483

Timeline

  • 2026-07-07: disclosed: Initial publication by maintainers
  • 2026-07-15: advisory: NVD publication
  • 2026-07-16: patched: GitHub Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.