Описание
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.
Ссылки
- Patch
- Issue TrackingPatch
- Release Notes
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.28.1 (исключая)
cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*
EPSS
Процентиль: 14%
0.00231
Низкий
8.1 High
CVSS3
Дефекты
CWE-346
Связанные уязвимости
github
около 1 месяца назад
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
EPSS
Процентиль: 14%
0.00231
Низкий
8.1 High
CVSS3
Дефекты
CWE-346