modelcontextprotocol has 19 CVEs on record. Disclosure cadence is accelerating: 18 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 14. The median CVSS is 7.3 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-770 (7) and CWE-200 (3). Most affected products: python-sdk (5), @modelcontextprotocol/sdk (4), rust-sdk (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.3
- Publish → KEV
- —
- Last 90 days
- 18 prev 1
Products
- python-sdk 5
- @modelcontextprotocol/sdk 4
- rust-sdk 3
- @modelcontextprotocol/server 1
- github.com/modelcontextprotocol/registry 1
- io.modelcontextprotocol.sdk:mcp 1
Worst active — by depth score
CVE-2026-63127High· 8.2RMCP is an official Rust SDK for the Model Context Protocol57CVE-2026-111770High· 7.7MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another54CVE-2026-104850High· 7.5MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients53CVE-2026-63128High· 7.5RMCP is an official Rust SDK for the Model Context Protocol53CVE-2026-104120High· 7.3A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.452
modelcontextprotocol vulnerabilities
CVEs affecting modelcontextprotocol, newest first. Open any entry for full detail, references, and exploit status.
19 CVEsRSS
CVE-2026-116684Medium· 6.8Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier ac…
CVE-2026-116686Medium· 6.5Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared output…
CVE-2026-116685Medium· 5.9Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and…
GHSA-f897-62hf-6gxqHigh· 7.5MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
CVE-2026-111771Medium· 6.8MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111770High· 7.7PoCMCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
CVE-2026-111768High· 7.5MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111769Medium· 6.5MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
CVE-2026-109527High· 7.5The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and…
CVE-2026-108395High· 7.5The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through …
CVE-2026-59951Medium· 6.9The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP)
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and …
CVE-2026-108714High· 7.5MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit
MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers …
CVE-2026-104850High· 7.5PoCMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to …
CVE-2026-104120High· 7.3PoCA security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4
A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the file mcp_server_fetch/server.py of the component Fetch Tool. The mani…
CVE-2026-64684Medium· 6.8RMCP is an official Rust SDK for the Model Context Protocol
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest…
CVE-2026-63128High· 7.5PoCRMCP is an official Rust SDK for the Model Context Protocol
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-fo…
CVE-2026-63127High· 8.2PoCRMCP is an official Rust SDK for the Model Context Protocol
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oau…
CVE-2026-53937Medium· 6.2PoCMCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared…
CVE-2026-45781Low· 3.5MCP Registry: OCI validator skips ownership check on upstream rate limits
MCP Registry: OCI validator skips ownership check on upstream rate limits