# cve.now: Modelcontextprotocol

The newest entries naming Modelcontextprotocol as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-111770](https://cve.now/CVE-2026-111770.md): Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another (CVSS 7.7)
- [CVE-2026-111768](https://cve.now/CVE-2026-111768.md): Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (CVSS 7.5)
- [CVE-2026-111769](https://cve.now/CVE-2026-111769.md): Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom… (CVSS 6.5)
- [CVE-2026-111771](https://cve.now/CVE-2026-111771.md): Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVSS 6.8)
- [CVE-2026-119025](https://cve.now/CVE-2026-119025.md): open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows (CVSS 7.7)
- [CVE-2026-116686](https://cve.now/CVE-2026-116686.md): Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas (CVSS 6.5)
- [CVE-2026-116685](https://cve.now/CVE-2026-116685.md): Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies (CVSS 5.9)
- [CVE-2026-116684](https://cve.now/CVE-2026-116684.md): Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server (CVSS 6.8)
- [CVE-2026-111767](https://cve.now/CVE-2026-111767.md): MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (CVSS 8.6)
- [CVE-2026-109527](https://cve.now/CVE-2026-109527.md): Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies (CVSS 7.5)
- [CVE-2026-108395](https://cve.now/CVE-2026-108395.md): Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies (CVSS 7.5)
- [CVE-2026-59951](https://cve.now/CVE-2026-59951.md): MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (CVSS 6.9)
- [CVE-2026-108714](https://cve.now/CVE-2026-108714.md): MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket (CVSS 8.7)
- [CVE-2026-104850](https://cve.now/CVE-2026-104850.md): MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (CVSS 7.5)
- [CVE-2026-104120](https://cve.now/CVE-2026-104120.md): modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch\_url server-side request forgery (CVSS 6.9)
- [CVE-2026-64684](https://cve.now/CVE-2026-64684.md): RMCP: Custom HTTP headers leak to cross-origin redirect targets (CVSS 6.8)
- [CVE-2026-63127](https://cve.now/CVE-2026-63127.md): RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery (CVSS 8.2)
- [CVE-2026-63128](https://cve.now/CVE-2026-63128.md): RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service (CVSS 7.5)
- [CVE-2026-53937](https://cve.now/CVE-2026-53937.md): MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS) (CVSS 6.2)
- [CVE-2026-53965](https://cve.now/CVE-2026-53965.md): MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service (CVSS 6.9)
- [CVE-2026-67432](https://cve.now/CVE-2026-67432.md): MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (CVSS 7.5)
- [CVE-2026-67431](https://cve.now/CVE-2026-67431.md): MCP Ruby SDK: Ruby SSE Session Poisoning (CVSS 8.3)
- [CVE-2026-63119](https://cve.now/CVE-2026-63119.md): MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (CVSS 6.2)
- [CVE-2026-67430](https://cve.now/CVE-2026-67430.md): MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (CVSS 5.3)
- [CVE-2026-63118](https://cve.now/CVE-2026-63118.md): MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (CVSS 6.9)
- [CVE-2026-59950](https://cve.now/CVE-2026-59950.md): MCP Python SDK: WebSocket server transport does not support Host/Origin validation (CVSS 7.6)
- [CVE-2026-52870](https://cve.now/CVE-2026-52870.md): MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks (CVSS 7.6)
- [CVE-2026-52869](https://cve.now/CVE-2026-52869.md): MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal (CVSS 7.1)
- [CVE-2026-44428](https://cve.now/CVE-2026-44428.md): MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience (CVSS 2.1)
- [CVE-2026-44427](https://cve.now/CVE-2026-44427.md): MCP Registry: Open Redirect (CVSS 0.0)
- [CVE-2026-44429](https://cve.now/CVE-2026-44429.md): MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled \`websiteUrl\` (CVSS 5.1)
- [CVE-2026-44430](https://cve.now/CVE-2026-44430.md): MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist (CVSS 6.3)
- [CVE-2026-45781](https://cve.now/CVE-2026-45781.md): MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims (CVSS 3.5)
- [CVE-2026-42559](https://cve.now/CVE-2026-42559.md): RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport (CVSS 8.8)
- [CVE-2026-35568](https://cve.now/CVE-2026-35568.md): MCP Java-SDK has a DNS Rebinding Vulnerability (CVSS 7.6)
- [CVE-2026-34742](https://cve.now/CVE-2026-34742.md): Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost (CVSS 7.6)
- [CVE-2026-34237](https://cve.now/CVE-2026-34237.md): MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: \*) (CVSS 6.1)
- [CVE-2026-33946](https://cve.now/CVE-2026-33946.md): MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (CVSS 8.2)
- [CVE-2026-33252](https://cve.now/CVE-2026-33252.md): MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion (CVSS 7.1)
- [CVE-2026-27896](https://cve.now/CVE-2026-27896.md): MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity (CVSS 7.0)
- [CVE-2026-27735](https://cve.now/CVE-2026-27735.md): mcp-server-git : Path traversal in git\_add allows staging files outside repository boundaries (CVSS 6.4)
- [CVE-2026-25536](https://cve.now/CVE-2026-25536.md): @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse (CVSS 7.1)
- [CVE-2025-68145](https://cve.now/CVE-2025-68145.md): mcp-server-git has missing path validation when using --repository flag (CVSS 6.4)
- [CVE-2025-68144](https://cve.now/CVE-2025-68144.md): mcp-server-git argument injection in git\_diff and git\_checkout functions allows overwriting local files (CVSS 6.3)
- [CVE-2025-68143](https://cve.now/CVE-2025-68143.md): mcp-server-git's unrestricted git\_init tool allows repository creation at arbitrary filesystem locations (CVSS 6.5)
- [CVE-2025-66416](https://cve.now/CVE-2025-66416.md): DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost (CVSS 7.6)
- [CVE-2025-66414](https://cve.now/CVE-2025-66414.md): DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost (CVSS 7.6)
- [CVE-2025-58444](https://cve.now/CVE-2025-58444.md): MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server (CVSS 8.6)
- [CVE-2025-53366](https://cve.now/CVE-2025-53366.md): MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service (CVSS 8.7)
- [CVE-2025-53365](https://cve.now/CVE-2025-53365.md): MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service (CVSS 8.7)
- [CVE-2025-53109](https://cve.now/CVE-2025-53109.md): Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling (CVSS 7.3)
- [CVE-2025-53110](https://cve.now/CVE-2025-53110.md): Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix (CVSS 7.3)
- [CVE-2025-49596](https://cve.now/CVE-2025-49596.md): MCP Inspector proxy server lacks authentication between the Inspector client and proxy (CVSS 9.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/modelcontextprotocol
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.