Advisoriesby Ibis
MCP SDKs security advisories
19 advisories · 11 critical or high in 12 months · latest Oct 27
19 advisories
MCP SDKs: improper authorizationCVE-2026-116684fixed in 1.30.0 +1MCP SDKs: information disclosureCVE-2026-116685fixed in 1.30.0 +1MCP SDKs: server-side request forgeryCVE-2026-116686fixed in 1.30.0 +1MCP SDKs: resource exhaustionGHSA-f897-62hf-6gxqfixed in 1.30.1MCP SDKs: resource exhaustionCVE-2026-111768fixed in 1.32.0MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceCVE-2026-111771fixed in 1.32.0MCP TypeScript SDK: Experimental tasks were not tied to the session that created themCVE-2026-111767fixed in 1.32.0MCP SDKs: information disclosureCVE-2026-111769fixed in 1.32.0MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-59951fixed in 1.30.0 +1MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverCVE-2026-104850fixed in 1.31.0MCP Python SDK: WebSocket server transport does not support Host/Origin validationCVE-2026-59950fixed in 1.28.1MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalCVE-2026-52869fixed in 1.27.2MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksCVE-2026-52870fixed in 1.27.2@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCVE-2026-25536fixed in 1.26.0Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityCVE-2026-0621fixed in 1.25.2Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultCVE-2025-66416fixed in 1.23.0Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultCVE-2025-66414fixed in 1.24.0MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSCVE-2025-53366fixed in 1.9.4MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceCVE-2025-53365fixed in 1.10.0About MCP SDKs
The Model Context Protocol SDKs for Python and TypeScript.
Packages watched: mcp (PyPI), @modelcontextprotocol/sdk (npm).