CVE-2026-59950: Lfprojects Mcp Python SDK

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.

Affected products

• Lfprojects Mcp Python SDK: before 1.28.1 (fixed in 1.28.1)

Published 2026-07-15. Last modified 2026-07-17.