Home › CVE Intelligence › CVE-2026-59950
CVSS 7.5 HIGH Vulnerability

CVE-2026-59950: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context P…

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes witho…

7.5CVSS Score
HIGHSeverity
NOCISA KEV
0.2%EPSS Score
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-59950
VendorUnknown Vendor
Affected ProductUnknown Product
Vulnerability TypeVulnerability
CVSS Score7.5 (HIGH)
EPSS Score0.2% probability of exploitation in the next 30 days
Actively Exploited❌ No known exploitation
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

🎯 Known Indicators of Compromise

{"type":"domain","value":"mcp.server.websocket","confidence_score":32.5,"first_seen":"2026-07-18","source_count":1} {"type":"indicator","value":"CVE-2026-59950","confidence_score":23.5,"first_seen":"2026-07-18","source_count":1}
⚡ DETECTION RULES AVAILABLE

Get CVE-2026-59950 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence