Security
فارسی
All products

mcp

PyPI · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116685 · GHSA-5H93-6WHR-6Q8J mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 PyPIRed Hat Medium Fix reported
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116684 · GHSA-W4FH-QVV9-3V23 mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 PyPIRed Hat Medium Fix reported
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasCVE-2026-116686 · GHSA-RWRF-2PQF-9J8J mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 PyPIRed Hat Medium Fix reported
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-59951 · GHSA-84M7-P3X7-PCFV mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 PyPIRed Hat Medium Fix reported
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksCVE-2026-52870 · GHSA-HVRP-RF83-W775Version ranges need review. mcp PyPI High Fix reported
MCP Python SDK: WebSocket server transport does not support Host/Origin validationCVE-2026-59950 · GHSA-VJ7Q-GJH5-988WVersion ranges need review. mcp PyPI High Fix reported
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalCVE-2026-52869 · GHSA-JPW9-PFVF-9F58Version ranges need review. mcp PyPI High Fix reported
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultCVE-2025-66416 · GHSA-9H52-P55H-VW2FVersion ranges need review. mcpOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat High Fix reported
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSCVE-2025-53366 · GHSA-3QHF-M339-9G5VVersion ranges need review. mcpOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat High Fix reported
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceCVE-2025-53365 · GHSA-J975-95F5-7WQHVersion ranges need review. mcpOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 PyPIRed Hat High Fix reported