Modelcontextprotocol vulnerabilities
53 CVEs and advisories name Modelcontextprotocol as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111770Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
- CVE-2026-111768Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
- CVE-2026-111769Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom…
- CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
- CVE-2026-119025open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
- CVE-2026-116686Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
- CVE-2026-116685Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
- CVE-2026-116684Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
- CVE-2026-111767MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
- CVE-2026-109527Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
- CVE-2026-108395Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
- CVE-2026-59951MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- CVE-2026-108714MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
- CVE-2026-104850MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
- CVE-2026-104120modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
- CVE-2026-64684RMCP: Custom HTTP headers leak to cross-origin redirect targets
- CVE-2026-63127RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
- CVE-2026-63128RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
- CVE-2026-53937MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
- CVE-2026-53965MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service
- CVE-2026-67432MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
- CVE-2026-67431MCP Ruby SDK: Ruby SSE Session Poisoning
- CVE-2026-63119MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
- CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
- CVE-2026-63118MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
- CVE-2026-59950MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-52870MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
- CVE-2026-52869MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- CVE-2026-44428MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
- CVE-2026-44427MCP Registry: Open Redirect