MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- Product
- mcp
- CVE
- CVE-2026-59950
- Affected
- pip/mcp < 1.28.1
- Fixed in
- 1.28.1
Last verified against sources: October 26, 2026
Am I affected?
mcp: affected pip/mcp < 1.28.1. Fixed in 1.28.1.
- Check your version: run
pip show mcp. Versions < 1.28.1 of mcp are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "mcp>=1.28.1"(first patched version 1.28.1). [1] - Upgrade to version 1.28.1 or later. [1]
- Pass a TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts / allowed_origins to receive the protection, because the parameter defaults to None, which leaves validation disabled. [1]
- Migrate off this deprecated transport to Streamable HTTP, where FastMCP enables this protection automatically for localhost binds. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. [1]
- The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect. [1]
- websocket_server() constructed a Starlette WebSocket and called accept(subprotocol="mcp") immediately, with no inspection of the connection's headers. [1]
Impact
- A web page served from any origin could open a WebSocket to a reachable MCP server on this transport, complete the initialize handshake, and issue JSON-RPC requests on the resulting session. [1]
- A user who runs an MCP server on this transport bound to localhost or a LAN address, without a separate authentication or origin gate in front of it, and visits a malicious web page, can have that page enumerate and invoke the server's tools and read its resources. [1]
- The transport itself requires no token or prior session. [1]
What was done
- Upgrade to version 1.28.1 or later, in which websocket_server() accepts the same optional security_settings: TransportSecuritySettings argument as the other HTTP-based transports and validates the Host and Origin headers before accepting the handshake. [1]
- A request that fails validation is rejected with HTTP 403 and ValueError("Request validation failed") is raised to the caller. [1]
- The WebSocket transport has been removed entirely in v2. [1]
Sources
- GHSA-vj7q-gjh5-988w — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-59950] MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Product: mcp | Affected: pip/mcp < 1.28.1 | Fixed in: 1.28.1
Summary: In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-59950-mcpCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-59950
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.