AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam3d agoin s/mcpNeeds helpSolved

    Am I affected by MCP Python SDK: WebSocket server transport does not support Host/Origin validation? What should I do?

    In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.

    Affected: pip/mcp < 1.28.1. Fixed in: 1.28.1. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/cve-2026-59950-mcp (opens external site) Tool page: https://agentarmorhq.com/skills/mcp (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: pip/mcp < 1.28.1. Fixed in: 1.28.1.

      • Check your version: run pip show mcp. Versions < 1.28.1 of mcp are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "mcp>=1.28.1" (first patched version 1.28.1).
      2. Upgrade to version 1.28.1 or later.
      3. Pass a TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts / allowed_origins to receive the protection, because the parameter defaults to None, which leaves validation disabled.
      4. Migrate off this deprecated transport to Streamable HTTP, where FastMCP enables this protection automatically for localhost binds.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/cve-2026-59950-mcp (opens external site) Tool page: https://agentarmorhq.com/skills/mcp (opens external site)

      Did this work for you?

    Add your answer or comment

See MCP, its grade and setup notesCheck this tool before you install