Skip to content
Modelcontextprotocol vulnerabilities
Newest
-
sindresorhus open, anomalyco opencode, mcpjam inspector +2 more
open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
CVE-2026-119025
Public exploit
7.7 High
-
modelcontextprotocol python-sdk
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
CVE-2026-116686
Fix available
6.5 Medium
-
modelcontextprotocol python-sdk
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
CVE-2026-116685
Fix available
5.9 Medium
-
modelcontextprotocol python-sdk
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
CVE-2026-116684
Fix available
6.8 Medium
-
modelcontextprotocol typescript-sdk
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
CVE-2026-111767
Fix available
8.6 High
-
modelcontextprotocol python-sdk
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
CVE-2026-109527
7.5 High
-
modelcontextprotocol io.modelcontextprotocol.sdk:mcp, io.modelcontextprotocol.sdk:mcp-core +1 more
Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
CVE-2026-108395
7.5 High
-
modelcontextprotocol python-sdk
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
CVE-2026-59951
Fix available
6.9 Medium
-
modelcontextprotocol kotlin-sdk
MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
CVE-2026-108714
8.7 High
-
modelcontextprotocol typescript-sdk
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-104850
Public exploitFix available
7.5 High
-
modelcontextprotocol mcp-server-everything, mcp-server-fetch +1 more
modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
CVE-2026-104120
6.9 Medium
-
modelcontextprotocol rust-sdk
RMCP: Custom HTTP headers leak to cross-origin redirect targets
CVE-2026-64684
Fix available
6.8 Medium
-
modelcontextprotocol rust-sdk
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
CVE-2026-63127
Fix available
8.2 High
-
modelcontextprotocol rust-sdk
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
CVE-2026-63128
Fix available
7.5 High
-
modelcontextprotocol io.modelcontextprotocol:kotlin-sdk, io.modelcontextprotocol:kotlin-sdk-client, io.modelcontextprotocol:kotlin-sdk-core +1 more +3 more
MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
CVE-2026-53937
6.2 Medium
-
modelcontextprotocol php-sdk
MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service
CVE-2026-53965
Fix available
6.9 Medium
-
modelcontextprotocol ruby-sdk
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
CVE-2026-67432
Fix available
7.5 High
-
modelcontextprotocol ruby-sdk
MCP Ruby SDK: Ruby SSE Session Poisoning
CVE-2026-67431
Fix available
8.3 High
-
modelcontextprotocol ruby-sdk
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
CVE-2026-63119
Fix available
6.2 Medium
-
modelcontextprotocol ruby-sdk
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
CVE-2026-67430
Fix available
5.3 Medium
-
modelcontextprotocol ruby-sdk
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
CVE-2026-63118
Fix available
6.9 Medium
-
lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
CVE-2026-59950
Fix available
7.6 High
-
lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
CVE-2026-52870
Fix available
7.6 High
-
lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
CVE-2026-52869
Fix available
7.1 High
-
modelcontextprotocol registry
MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
CVE-2026-45781
Fix available
3.5 Low
-
lfprojects mcp registry, modelcontextprotocol registry +1 more
MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
CVE-2026-44430
Fix available
6.3 Medium
-
lfprojects mcp registry, modelcontextprotocol registry +1 more
MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`
CVE-2026-44429
Fix available
5.1 Medium
-
lfprojects mcp registry, modelcontextprotocol registry +1 more
MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
CVE-2026-44428
Fix available
2.1 Low
-
modelcontextprotocol registry
MCP Registry: Open Redirect
CVE-2026-44427
Fix available
0.0 None
-
modelcontextprotocol rust-sdk
RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
CVE-2026-42559
Public exploitFix available
8.8 High
-
lfprojects mcp java sdk, modelcontextprotocol java-sdk +1 more
MCP Java-SDK has a DNS Rebinding Vulnerability
CVE-2026-35568
Fix available
7.6 High
-
lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +4 more +6 more
Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost
CVE-2026-34742
Fix available
7.6 High
-
lfprojects mcp java sdk, modelcontextprotocol java-sdk +1 more
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
CVE-2026-34237
Fix available
6.1 Medium
-
lfprojects mcp ruby sdk, modelcontextprotocol ruby-sdk +1 more
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
CVE-2026-33946
Fix available
8.2 High
-
lfprojects mcp go sdk, modelcontextprotocol go-sdk +1 more
MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
CVE-2026-33252
Fix available
7.1 High
-
lfprojects mcp go sdk, modelcontextprotocol go-sdk, red hat migration toolkit for virtualization +3 more +5 more
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
CVE-2026-27896
Fix available
7.0 High
-
lfprojects model context protocol servers, modelcontextprotocol servers +1 more
mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
CVE-2026-27735
Fix available
6.4 Medium
-
lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk, red hat ansible automation platform 2.6 +2 more
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
CVE-2026-25536
Fix available
7.1 High
-
lfprojects model context protocol servers, modelcontextprotocol servers +1 more
mcp-server-git has missing path validation when using --repository flag
CVE-2025-68145
Fix available
6.4 Medium
-
lfprojects model context protocol servers, modelcontextprotocol servers +1 more
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
CVE-2025-68144
Fix available
6.3 Medium
-
lfprojects model context protocol servers, modelcontextprotocol servers +1 more
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
CVE-2025-68143
Fix available
6.5 Medium
-
lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more
DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost
CVE-2025-66416
Fix available
7.6 High
-
lfprojects mcp typescript sdk, modelcontextprotocol typescript-sdk +1 more
DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost
CVE-2025-66414
Fix available
7.6 High
-
mcpjam inspector
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
CVE-2025-58444
Fix available
8.6 High
-
modelcontextprotocol python-sdk
MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
CVE-2025-53366
Fix available
8.7 High
-
modelcontextprotocol python-sdk
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service
CVE-2025-53365
Fix available
8.7 High
-
modelcontextprotocol servers
Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix
CVE-2025-53110
Fix available
7.3 High
-
modelcontextprotocol servers
Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling
CVE-2025-53109
Fix available
7.3 High
-
mcpjam inspector
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
CVE-2025-49596
Public exploitFix available
EPSS 44.5%
9.4 Critical