mcp vulnerabilities
CVEs whose affected-version data names the mcp package (pip, rubygems). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
13 CVEsRSS
CVE-2026-116684Medium· 6.8Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
CVE-2026-116685Medium· 5.9Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
CVE-2026-94044High· 7.3A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546
A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content lead…
CVE-2026-63118MediumMCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
CVE-2026-63119Medium· 6.2MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
CVE-2026-67430Medium· 5.3MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
CVE-2026-67432High· 7.5MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
CVE-2026-67431HighMCP Ruby SDK: Ruby SSE Session Poisoning
MCP Ruby SDK: Ruby SSE Session Poisoning
CVE-2026-52869High· 7.1MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
CVE-2026-59950HighMCP Python SDK: WebSocket server transport does not support Host/Origin validation
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
CVE-2026-52870High· 7.6MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
CVE-2025-53365HighMCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
CVE-2025-53366HighMCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS