Modelcontextprotocol Python-sdk vulnerabilities

• modelcontextprotocol python-sdk Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas CVE-2026-116686 Fix available 6.5 MediumOctober 27, 2026
• modelcontextprotocol python-sdk Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies CVE-2026-116685 Fix available 5.9 MediumOctober 27, 2026
• modelcontextprotocol python-sdk Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server CVE-2026-116684 Fix available 6.8 MediumOctober 27, 2026
• modelcontextprotocol python-sdk Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies CVE-2026-109527 7.5 HighOctober 14, 2026
• modelcontextprotocol python-sdk MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion CVE-2026-59951 Fix available 6.9 MediumOctober 14, 2026
• lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more MCP Python SDK: WebSocket server transport does not support Host/Origin validation CVE-2026-59950 Fix available 7.6 HighJuly 15, 2026
• lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks CVE-2026-52870 Fix available 7.6 HighJuly 15, 2026
• lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal CVE-2026-52869 Fix available 7.1 HighJuly 15, 2026
• lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 more DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost CVE-2025-66416 Fix available 7.6 HighDecember 2, 2025
• modelcontextprotocol python-sdk MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service CVE-2025-53366 Fix available 8.7 HighJuly 4, 2025
• modelcontextprotocol python-sdk MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service CVE-2025-53365 Fix available 8.7 HighJuly 4, 2025