Mcp - CraftedSignal Threat Feed

MCP Python SDK WebSocket Server Lacks Host/Origin Validation

hello@craftedsignal.io — Thu, 16 Jul 2026 20:17:38 +0000

A high-severity vulnerability, identified as CVE-2026-59950, exists in versions of the MCP Python SDK prior to 1.28.1. Specifically, the deprecated mcp.server.websocket.websocket_server component, which handles WebSocket server transport, fails to perform Host or Origin header validation during the WebSocket handshake. This oversight allows cross-origin WebSocket upgrade requests, typically blocked by browser same-origin policies, to be accepted by the server without inspection. A developer must have manually wired this deprecated transport into an ASGI application, as it is not part of the standard MCP specification nor reachable through FastMCP. The vulnerability enables a malicious webpage to open an unauthorized WebSocket connection to a reachable MCP server instance, potentially allowing for the enumeration and invocation of server-side tools and the reading of resources, depending on the server's exposed functionalities. This issue primarily affects users running MCP servers bound to localhost or local area network addresses without external authentication or origin validation.

Attack Chain

A user navigates to a malicious webpage controlled by an attacker.
The malicious webpage, served from any origin, attempts to establish a WebSocket connection to a local or LAN-accessible MCP server running the vulnerable mcp.server.websocket.websocket_server transport on the user's system (e.g., ws://localhost:XXXX/mcp/ws).
The MCP server, due to the lack of Host and Origin header validation in its websocket_server() implementation, accepts the cross-origin WebSocket handshake from the malicious webpage.
A Starlette WebSocket connection is established, and the initialize handshake is completed without requiring any token or prior session.
The malicious webpage sends JSON-RPC requests over the established WebSocket connection to the MCP server.
The MCP server processes these unauthorized JSON-RPC requests, allowing the malicious webpage to invoke server-side tools and read sensitive resources exposed by the server.
The final impact depends on the specific functionalities exposed by the exploited MCP server, potentially leading to information disclosure or arbitrary command execution.

Impact

The successful exploitation of CVE-2026-59950 can allow a malicious webpage to establish an unauthorized WebSocket connection to a vulnerable MCP server running on the victim's localhost or local area network. If the server is exposed without additional authentication or origin gates, the malicious webpage can enumerate and invoke the server's tools and read its resources. The direct consequences of exploitation are entirely dependent on the specific functionalities and data exposed by the MCP server instance. For instance, if the server exposes sensitive tools or configuration data, an attacker could potentially execute arbitrary commands or exfiltrate confidential information. While some browsers may prompt a user before allowing connections to local network addresses, this user interaction is not a substitute for robust server-side validation.

Recommendation

Upgrade the mcp Python SDK to version 1.28.1 or later to apply the patch for CVE-2026-59950.
Configure TransportSecuritySettings with enable_dns_rebinding_protection=True and appropriate allowed_hosts and allowed_origins when initializing websocket_server() to enable proper Host/Origin header validation.
Migrate off the deprecated websocket_server() transport to Streamable HTTP where FastMCP automatically provides protection for localhost binds.
Ensure that any MCP server instances exposed to networks (even local) are protected by a separate authentication or origin validation layer.

MCP Python SDK Authentication Bypass Vulnerability (CVE-2026-52869)

hello@craftedsignal.io — Thu, 16 Jul 2026 19:59:49 +0000

A significant authentication bypass vulnerability, identified as CVE-2026-52869, has been discovered in the MCP Python SDK versions up to 1.27.1. This flaw specifically impacts application servers using either the SSE (mcp.server.sse.SseServerTransport) or Streamable HTTP (mcp.server.streamable_http_manager.StreamableHTTPSessionManager) transports in stateful mode, particularly when authentication is configured. The vulnerability stems from the transports routing incoming requests to an existing session based solely on the session identifier (a query parameter or header), without validating that the request originates from the same authenticated principal who initially created the session. This oversight allows an attacker who can acquire or guess a session ID to inject unauthorized JSON-RPC messages into an active session, effectively bypassing the per-client isolation intended by authentication. The SSE transport has been affected since its initial release, while the Streamable HTTP transport became vulnerable in version 1.8.0.

Attack Chain

Initial Reconnaissance: The attacker identifies a target application server utilizing the MCP Python SDK with HTTP transports (SSE or Streamable HTTP) and configured authentication.
Session ID Acquisition: The attacker obtains an active session ID for a legitimate user through out-of-band means such as sniffing network traffic, log compromise, or brute-forcing (session IDs are UUIDs, making brute-force difficult but not impossible).
Crafting Malicious Request: The attacker crafts a request containing malicious JSON-RPC messages, including the obtained legitimate session_id (for SSE) or Mcp-Session-Id header (for Streamable HTTP).
Authentication Bypass: The attacker sends the malicious request to the vulnerable server. The server routes the request to the target session solely based on the session ID, bypassing principal authentication checks.
Message Injection: The server processes the attacker's JSON-RPC messages within the context of the legitimate user's session, despite the request carrying a different or invalid bearer token.
Impact on Session: The injected messages can alter the session state, perform unauthorized actions, or exfiltrate sensitive information, depending on the application's functionality.
Response Delivery: For SSE, the response to the injected message is delivered to the original legitimate client's event stream. For Streamable HTTP, the injecting client receives the response directly.
Achieve Objective: The attacker successfully compromises session integrity, leading to unauthorized data manipulation or access, bypassing the intended per-client isolation.

Impact

If successfully exploited, CVE-2026-52869 allows an attacker to bypass critical per-client isolation mechanisms provided by authentication in application servers using the MCP Python SDK's HTTP transports. This means that an attacker, upon obtaining a valid session ID, can inject arbitrary JSON-RPC messages into another user's active session. The direct consequence is unauthorized access and potential manipulation of session-dependent data or functionality. While session IDs are randomly generated UUIDs, making blind guessing difficult, any out-of-band leakage (e.g., via logs, network observation, or cross-site scripting) would enable exploitation. The impact could range from data corruption or unauthorized information disclosure to complete account compromise, depending on the privileges associated with the compromised session and the capabilities of the JSON-RPC interface.

Recommendation

Upgrade the pip/mcp package to version 1.27.2 or later immediately to address CVE-2026-52869.
Ensure that, for deployments where many end users share a single OAuth client, the token verifier populates AccessToken.subject (e.g., from the token's sub claim) to enforce per-user session isolation.
Review custom authentication backends, if used, to ensure they enforce equivalent principal verification checks as introduced in MCP Python SDK 1.27.2.

MCP Python SDK Vulnerability Allows Cross-Client Task Access and Cancellation (CVE-2026-52870)

hello@craftedsignal.io — Thu, 16 Jul 2026 19:57:09 +0000

A significant vulnerability, tracked as CVE-2026-52870, has been identified in the experimental tasks feature of the MCP Python SDK, affecting versions 1.23.0 through 1.27.1. When developers explicitly enable this feature by calling server.experimental.enable_tasks(), the default request handlers for tasks (tasks/list, tasks/get, tasks/result, tasks/cancel) fail to validate which client session created a specific task. This critical oversight allows any client connected to the server to enumerate, access, retrieve results from, and cancel tasks initiated by other clients. The impact includes unauthorized disclosure of task results and elicitation payloads, interception of messages intended for other clients, and potential denial of service by prematurely terminating ongoing tasks. This flaw presents a serious risk to multi-client applications utilizing the experimental task management functionality, enabling malicious clients to disrupt operations and exfiltrate sensitive data.

Attack Chain

An attacker establishes a connection to a server running the vulnerable MCP Python SDK application with server.experimental.enable_tasks() enabled, posing as a legitimate client.
The attacker sends a tasks/list request to the server, which, due to the vulnerability, returns a list of all active tasks across all connected client sessions.
Using the task identifiers obtained from the tasks/list response, the attacker sends tasks/get and tasks/result requests to retrieve the status and outcomes of tasks belonging to other clients.
The attacker may also retrieve queued task messages, such as elicitation requests, intended for other clients, effectively consuming messages and preventing the legitimate recipient from receiving them.
The attacker can then analyze the sensitive data contained within these task results or messages.
As a final step, the attacker sends tasks/cancel requests for tasks identified in previous steps, terminating legitimate operations initiated by other clients, leading to a denial of service.

Impact

Servers utilizing the affected MCP Python SDK versions (1.23.0 to 1.27.1) with the experimental tasks feature enabled are at risk. This vulnerability allows for unauthorized access to sensitive task results and elicitation payloads belonging to other clients, compromising data confidentiality. Furthermore, attackers can intercept messages meant for legitimate clients and disrupt service by canceling tasks, leading to operational downtime or data inconsistencies. The direct consequences could range from competitive intelligence gathering to sabotage of critical business processes, particularly in environments where multiple clients interact with shared server resources. The number of directly affected organizations depends on the adoption rate of this specific experimental and opt-in feature.

Recommendation

Upgrade the MCP Python SDK to version 1.27.2 or later immediately to address CVE-2026-52870, which embeds opaque per-session markers in task IDs and restricts access to session-specific tasks.
If immediate upgrade is not feasible, ensure that the server.experimental.enable_tasks() feature is disabled in your application configuration.
For applications requiring task handlers, register custom handlers that explicitly validate session ownership for each task request (tasks/list, tasks/get, tasks/result, tasks/cancel) to prevent unauthorized cross-client access.