- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 6 high, 4 medium
- Weekly downloads
- 71.1M
- Dependents
- 26.5K
- Registry
- PyPI
Advisories 10
- CVE-2026-116686Medium 6.5
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
Affected: from 2.0.0, fixed in 2.2.0; from 1.10.0, fixed in 1.30.0.
- CVE-2026-116685Medium 5.9
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
Affected: from 2.0.0, fixed in 2.2.0; from 1.8.0, fixed in 1.30.0.
- CVE-2026-116684Medium 6.8
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
Affected: from 2.0.0, fixed in 2.2.0; from 1.10.0, fixed in 1.30.0.
- CVE-2026-59951Medium 6.9
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Affected: from 1.8.0, fixed in 1.30.0; from 2.0.0, fixed in 2.2.0.
- CVE-2026-59950High 7.6
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Affected: fixed in 1.28.1.
- CVE-2026-52870High 7.6
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Affected: from 1.23.0, fixed in 1.27.2.
- CVE-2026-52869High 7.1
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Affected: fixed in 1.27.2.
- CVE-2025-66416High 7.6
DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost
Affected: fixed in 1.23.0.
- CVE-2025-53366High 8.7
MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
Affected: fixed in 1.9.4.
- CVE-2025-53365High 8.7
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service
Affected: fixed in 1.10.0.