VulnSocial

CVE-2026-59950General(lfprojects / mcp_python_sdk)

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

lfprojects CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-346CWE-1385

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mcp_python_sdk

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • General: 2 classified signals
  • 2 total mentions across 1 day

Affected systems

Vendors
lfprojects
Products
mcp_python_sdk

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-15: 207-15
Signal classification1 categories
General
2100.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket… https://www.cve.org/CVERecord?id=CVE-2026-59950 ----- Traducción: CVE-2026-59950 El … http://infoflow.cloud`

    Post summary

    The post simply references CVE‑2026‑59950 with a link to the CVE record, providing no additional details, patches, or exploitation information.

    0000037
    92 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket… https://www.cve.org/CVERecord?id=CVE-2026-59950

    Post summary

    CVE-2026-59950 is briefly mentioned in relation to the MCP Python SDK, noting a deprecated websocket component before version 1.28.1; no further technical or exploit details are provided.

    00000704
    57.8K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applfprojectsmcp_python_sdk---

Explore more

Back to dashboardlfprojects CVEsmcp_python_sdk vulnerabilities