CVE-2026-59950: MCP Python SDK Auth Bypass Vulnerability

CVE-2026-59950 Overview

CVE-2026-59950 affects the MCP Python SDK, the official Python implementation of the Model Context Protocol (MCP) distributed as mcp on PyPI. Versions prior to 1.28.1 contain a flaw in the deprecated mcp.server.websocket.websocket_server transport. The transport accepted WebSocket handshakes without validating the Host or Origin headers. Applications exposing this transport had no SDK-level mechanism to restrict which origins could connect. This condition maps to [CWE-346] Origin Validation Error and enables cross-site WebSocket hijacking against MCP servers reachable from a victim browser. The issue is fixed in version 1.28.1.

Critical Impact
A remote attacker can trick a user's browser into initiating unauthenticated WebSocket connections to an MCP server, exposing tools, prompts, and resources to attacker-controlled origins.

Affected Products

mcp Python SDK on PyPI, versions prior to 1.28.1
Applications using the deprecated mcp.server.websocket.websocket_server transport
Model Context Protocol server implementations built on the Python SDK WebSocket transport

Discovery Timeline

2026-07-15 - CVE-2026-59950 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-59950

Vulnerability Analysis

The MCP Python SDK exposes multiple server transports for the Model Context Protocol. The deprecated WebSocket server transport in mcp.server.websocket established sessions on incoming handshakes without inspecting the Origin or Host request headers. Browsers enforce the Same-Origin Policy for XHR and Fetch requests but do not block cross-origin WebSocket handshakes by default. A malicious web page loaded in a victim's browser can therefore open a WebSocket to any MCP server reachable by that browser, including localhost and internal network hosts. Once connected, the attacker's JavaScript can invoke tools, read resources, and drive prompts as the local user.

Root Cause

The root cause is missing origin validation in the WebSocket handshake path. The transport module imported starlette.requests.Request and returned a Response without any middleware to compare the incoming Origin header against an allow-list. Because the SDK provided no configuration hooks for this check, application authors could not restrict origins at the SDK layer.

Attack Vector

Exploitation requires a user to visit an attacker-controlled page while an MCP server using the vulnerable WebSocket transport is reachable, typically on localhost or a trusted intranet host. The attacker page issues a new WebSocket() call to the server URL. The handshake succeeds, and the attacker channel receives full MCP session privileges. No authentication prompt is presented because the transport does not gate the upgrade.

python

# Patch: src/mcp/server/transport_security.py
 import logging
 
 from pydantic import BaseModel, Field
-from starlette.requests import Request
+from starlette.requests import HTTPConnection
 from starlette.responses import Response
 
 logger = logging.getLogger(__name__)

Source: GitHub Commit 777b8d0

python

# Patch: src/mcp/server/websocket.py
 from typing_extensions import deprecated
 
 import mcp.types as types
+from mcp.server.transport_security import TransportSecurityMiddleware, TransportSecuritySettings
 from mcp.shared.message import SessionMessage
 
 logger = logging.getLogger(__name__)

Source: GitHub Commit 777b8d0. The fix wires TransportSecurityMiddleware and TransportSecuritySettings into the WebSocket transport so applications can enforce Host and Origin allow-lists.

Detection Methods for CVE-2026-59950

Indicators of Compromise

WebSocket upgrade requests to MCP endpoints where the Origin header does not match the expected application domain or is absent.
Successful MCP tool invocations originating from browser user-agents on localhost-bound servers not intended for browser access.
Access log entries showing WebSocket connections from file://, null, or arbitrary third-party origins on ports hosting MCP services.

Detection Strategies

Inventory Python environments for mcp package versions and flag any installation earlier than 1.28.1.
Audit application code for imports of mcp.server.websocket.websocket_server and confirm whether the transport is exposed at runtime.
Inspect reverse proxy and web server logs for cross-origin WebSocket handshakes to MCP listener ports.

Monitoring Recommendations

Enable structured logging of Origin and Host headers on all WebSocket endpoints hosting MCP transports.
Alert on MCP tool executions where the initiating session was established from an unrecognized origin.
Track outbound package installations in developer and workstation environments to catch downgrade to affected mcp versions.

How to Mitigate CVE-2026-59950

Immediate Actions Required

Upgrade the mcp PyPI package to version 1.28.1 or later in every environment running the WebSocket transport.
Configure TransportSecuritySettings with an explicit allow-list for permitted Host and Origin values.
Prefer non-deprecated MCP transports such as stdio or the Streamable HTTP transport where feasible.

Patch Information

The fix ships in MCP Python SDK v1.28.1. The change introduces TransportSecurityMiddleware and TransportSecuritySettings in the WebSocket transport, aligning it with other transports that already supported header validation. Full technical context is in the GHSA-vj7q-gjh5-988w advisory and Pull Request #2992.

Workarounds

Bind MCP WebSocket servers to loopback interfaces only when browser exposure is not required.
Front the MCP WebSocket endpoint with a reverse proxy that validates Origin and rejects handshakes from untrusted domains.
Require authentication tokens on the initial WebSocket URL or in a subprotocol until the SDK upgrade is deployed.

bash

# Upgrade the MCP Python SDK to the patched release
pip install --upgrade "mcp>=1.28.1"

# Verify the installed version
python -c "import mcp, importlib.metadata as m; print(m.version('mcp'))"