modelcontextprotocol vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-116686 New	PY python-sdk modelcontextprotocol	6.5	–	Oct 27	Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
CVE-2026-116685 New	PY python-sdk modelcontextprotocol	5.9	–	Oct 27	Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
CVE-2026-116684 New	PY python-sdk modelcontextprotocol	6.8	–	Oct 27	Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
CVE-2026-111767	TY typescript-sdk modelcontextprotocol	8.6	0%	Oct 20	MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
CVE-2026-109527	PY python-sdk modelcontextprotocol	7.5	1%	Oct 14	Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
CVE-2026-108395	IO io.modelcontextprotocol.sdk:mcp modelcontextprotocol	7.5	1%	Oct 14	Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
CVE-2026-59951	PY python-sdk modelcontextprotocol	6.9	0%	Oct 14	MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
CVE-2026-108714	KO kotlin-sdk modelcontextprotocol	7.5	0%	Oct 11	MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket
CVE-2026-104850	TY typescript-sdk modelcontextprotocol	7.5	0%	Oct 6	MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-104120	MC mcp-server-everything modelcontextprotocol	7.3	0%	Oct 2	modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
CVE-2026-64684	RU rust-sdk modelcontextprotocol	6.8	0%	Sep 16	RMCP: Custom HTTP headers leak to cross-origin redirect targets
CVE-2026-63127	RU rust-sdk modelcontextprotocol	8.2	0%	Sep 16	RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
CVE-2026-63128	RU rust-sdk modelcontextprotocol	7.5	1%	Sep 16	RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
CVE-2026-53937	IO io.modelcontextprotocol:kotlin-sdk modelcontextprotocol	6.2	0%	Sep 8	MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
CVE-2026-53965	PH php-sdk modelcontextprotocol	6.9	1%	Aug 25	MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service
CVE-2026-67432	RU ruby-sdk modelcontextprotocol	7.5	1%	Jul 29	MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
CVE-2026-67431	RU ruby-sdk modelcontextprotocol	8.3	0%	Jul 29	MCP Ruby SDK: Ruby SSE Session Poisoning
CVE-2026-63119	RU ruby-sdk modelcontextprotocol	6.2	0%	Jul 29	MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
CVE-2026-67430	RU ruby-sdk modelcontextprotocol	5.3	0%	Jul 29	MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
CVE-2026-63118	RU ruby-sdk modelcontextprotocol	6.9	0%	Jul 29	MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
CVE-2026-59950	PY python-sdk modelcontextprotocol	8.1	0%	Jul 15	MCP Python SDK: WebSocket server transport does not support Host/Origin validation
CVE-2026-52870	PY python-sdk modelcontextprotocol	7.6	0%	Jul 15	MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
CVE-2026-52869	PY python-sdk modelcontextprotocol	7.1	1%	Jul 15	MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
CVE-2026-44428	RE registry modelcontextprotocol	4.7	0%	May 14	MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience
CVE-2026-44427	RE registry modelcontextprotocol	0.0	0%	May 14	MCP Registry: Open Redirect
CVE-2026-44429	RE registry modelcontextprotocol	5.4	0%	May 14	MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`
CVE-2026-44430	RE registry modelcontextprotocol	4.0	0%	May 14	MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist
CVE-2026-45781	RE registry modelcontextprotocol	3.5	0%	May 14	MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims
CVE-2026-42559	RU rust-sdk modelcontextprotocol	8.8	0%	May 14	RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
CVE-2026-35568	JA java-sdk modelcontextprotocol	5.7	0%	Apr 7	MCP Java-SDK has a DNS Rebinding Vulnerability
CVE-2026-34742	GO go-sdk modelcontextprotocol	8.1	0%	Apr 2	Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost
CVE-2026-34237	JA java-sdk modelcontextprotocol	6.1	0%	Mar 31	MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
CVE-2026-33946	RU ruby-sdk modelcontextprotocol	5.9	0%	Mar 27	MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
CVE-2026-33252	GO go-sdk modelcontextprotocol	6.5	0%	Mar 23	MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion