Executive brief
The Model Context Protocol (MCP) Python SDK contains a security flaw in its WebSocket server component. If a developer uses this specific component to host a server, a malicious website visited by a user could bypass standard browser protections to interact with that server. This could allow an attacker to access private data or execute commands on the user's local network or machine, depending on what the server is configured to do.
Technical details
A vulnerability exists in the deprecated `mcp.server.websocket.websocket_server` transport where it fails to implement `Host` or `Origin` header validation during the WebSocket handshake. While browsers enforce Same-Origin Policy (SOP) for standard web requests, they do not enforce it for WebSocket connections, relying instead on the server to validate the `Origin` header. An attacker can leverage this by hosting a malicious webpage that, when visited by a user, initiates a WebSocket connection to an MCP server running on the user's localhost or LAN. Once connected, the attacker can perform JSON-RPC calls to enumerate tools and read resources. The issue is fixed in version 1.28.1 by integrating `TransportSecuritySettings` into the WebSocket transport, though it must be explicitly enabled.
Affected products
- Model Context Protocol (MCP) mcp < 1.28.1
Timeline
- 2026-07-07: disclosed: Initial publication by maintainers
- 2026-07-15: advisory: NVD publication
- 2026-07-16: patched: GitHub Advisory updated and reviewed
References
- https://api.github.com/users/nitish-yaddala
- https://github.com/nitish-yaddala
- https://api.github.com/users/nitish-yaddala/gists%7B/gist_id%7D
- https://api.github.com/users/nitish-yaddala/repos
- https://avatars.githubusercontent.com/u/81429430?v=4
- https://api.github.com/users/nitish-yaddala/events%7B/privacy%7D