--- schema_version: '1.0' id: security-20260724-2aafed url: https://osv.dev/vulnerability/PYSEC-2026-3483 url_hash: 2aafedce3e777a134f8a1e1d50e4755b7edc41435017a5e4f67ec75de132b53f canonical_url: https://osv.dev/vulnerability/PYSEC-2026-3483 source: osv:pypa category: security/library category_raw: cve/library region: null tags: - cve - CVE-2026-59950 - PYSEC-2026-3483 - severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - mcp - PyPI lang: en published_at: '2026-07-23T11:41:46Z' fetched_at: '2026-07-24T07:01:54.527062Z' updated_at: '2026-07-24T07:02:21Z' status: published content_hash: fd734a55cbaa0d0d90dea4634a17ab7b504ce024b8b1a0ee7753271ea09a8070 content_changed_at: null license_note: full summary: 'MCP Python SDK: WebSocket server transport does not support Host/Origin validation' summary_source: rss summary_en: 'MCP Python SDK: WebSocket server transport does not support Host/Origin validation' entities: - name: CVE-2026-44243 type: data - name: MCP type: concept - name: Python REPL type: UNKNOWN key_facts: [] related: [] related_auto: - name: 本人・法人認証 type: UNKNOWN weight: 1.0 - name: 監査ログ type: UNKNOWN weight: 1.0 - name: agent_d_bot type: person weight: 1.0 title: 'CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation' --- # CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation ## TL;DR MCP Python SDK: WebSocket server transport does not support Host/Origin validation ## Key Points - cve / CVE-2026-59950 / PYSEC-2026-3483 / severity:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N / mcp / PyPI ## Details **Severity:** CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N **Advisory:** PYSEC-2026-3483 (CVE-2026-59950) **Affected (your watchlist):** - `PyPI:mcp` 1.26.0 → fixed in 1.28.1 [docker/local+docker/mac] - `PyPI:mcp` 1.27.2 → fixed in 1.28.1 [docker/local] - `PyPI:mcp` 1.28.0 → fixed in 1.28.1 [docker/mac] **Details:** ### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect. ### Am I affected? Only if a developer's application server exposes `mcp.server.websocket.websocket_server`. This transport has never been part of the MCP specification, is marked deprecated, and is not reachable through `FastMCP` — a developer must have wired it into an ASGI application themselves. Servers using stdio, SSE, or Streamable HTTP are not affected by this advisory. ### Details `websocket_server()` constructed a Starlette `WebSocket` and called `accept(subprotocol="mcp")` immediately, with no inspection of the connection's headers. By contrast, `SseServerTransport` and `StreamableHTTPServerTransport` accept an optional `security_settings: TransportSecuritySettings` and run `TransportSecurityMiddleware.validate_request()` against the incoming `Host` and `Origin` headers before establishing a session. Because browsers attach an `Origin` header to cross-origin WebSocket upgrade requests but do not enforce a same-origin policy on the response, a web page served from any origin could open a WebSocket to a reachable MCP server on this transport, complete the `initialize` handshake, and issue JSON-RPC requests on the resulting session. ### Impact A user who runs an MCP server on this transport bound to localhost or a LAN address, without a separate authentication or origin gate in front of it, and visits a malicious web page, can have that page enumerate and invoke the server's tools and read its resources. The consequences depend entirely on what the server exposes. The transport itself requires no token or prior session. Some browsers prompt before allowing a public page to open a connection to a local-network address, which adds a user-interaction step but is not a substitute for server-side validation. ### Mitigation Upgrade to version 1.28.1 or later, in which `websocket_server()` accepts the same optional `security_settings: TransportSecuritySettings` argument as the other HTTP-based transports and validates the `Host` and `Origin` headers before accepting the handshake; a request that fails validation is rejected with HTTP 403 and `ValueError("Request validation failed")` is raised to the caller. As with the other transports the parameter defaults to `None`, which leaves validation disabled, so upgrading alone does not change behaviour: pass a `TransportSecuritySettings` with `enable_dns_rebinding_protection=True` and appropriate `allowed_hosts` / `allowed_origins` to receive the protection. The recommended path remains to migrate off this deprecated transport to Streamable HTTP, where `FastMCP` enables this protection automatically for localhost binds. The WebSocket transport has been removed entirely in v2. **References:** - https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w - https://nvd.nist.gov/vuln/detail/CVE-2026-59950 - https://github.com/modelcontextprotocol/python-sdk/pull/2992 - https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266 - https://github.com/modelcontextprotocol/python-sdk - https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1 - https://pypi.org/project/mcp - https://github.com/advisories/GHSA-vj7q-gjh5-988w _Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-3483_ ## Source 元記事: [CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validation](https://osv.dev/vulnerability/PYSEC-2026-3483) — published 2026-07-23T11:41:46Z