Attack Chain

1. A user navigates to a malicious webpage controlled by an attacker.
2. The malicious webpage, served from any origin, attempts to establish a WebSocket connection to a local or LAN-accessible MCP server running the vulnerable mcp.server.websocket.websocket_server transport on the user's system (e.g., ws://localhost:XXXX/mcp/ws).
3. The MCP server, due to the lack of Host and Origin header validation in its websocket_server() implementation, accepts the cross-origin WebSocket handshake from the malicious webpage.
4. A Starlette WebSocket connection is established, and the initialize handshake is completed without requiring any token or prior session.
5. The malicious webpage sends JSON-RPC requests over the established WebSocket connection to the MCP server.
6. The MCP server processes these unauthorized JSON-RPC requests, allowing the malicious webpage to invoke server-side tools and read sensitive resources exposed by the server.
7. The final impact depends on the specific functionalities exposed by the exploited MCP server, potentially leading to information disclosure or arbitrary command execution.

Impact

The successful exploitation of CVE-2026-59950 can allow a malicious webpage to establish an unauthorized WebSocket connection to a vulnerable MCP server running on the victim's localhost or local area network. If the server is exposed without additional authentication or origin gates, the malicious webpage can enumerate and invoke the server's tools and read its resources. The direct consequences of exploitation are entirely dependent on the specific functionalities and data exposed by the MCP server instance. For instance, if the server exposes sensitive tools or configuration data, an attacker could potentially execute arbitrary commands or exfiltrate confidential information. While some browsers may prompt a user before allowing connections to local network addresses, this user interaction is not a substitute for robust server-side validation.

Recommendation

• Upgrade the mcp Python SDK to version 1.28.1 or later to apply the patch for CVE-2026-59950.
• Configure TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts and allowed_origins when initializing websocket_server() to enable proper Host/Origin header validation.
• Migrate off the deprecated websocket_server() transport to Streamable HTTP where FastMCP automatically provides protection for localhost binds.
• Ensure that any MCP server instances exposed to networks (even local) are protected by a separate authentication or origin validation layer.