Category · 31 advisories
MCP
Model Context Protocol: the SDKs, servers and clients that wire tools into agents.
Timeline · advisories per quarter
32025 Q2
82025 Q3
22025 Q4
62026 Q1
32026 Q3
92026 Q4
All advisories, worst first
01. CVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commandsBefore 0.2.121, the Python Claude Agent SDK passed the resume session ID straight to the Claude CLI. A value starting with a dash became a CLI flag, so an attacker could inject an MCP server config and run commands. 
Claude Code 
MCP SDKs & servers 2026-10-16 02. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. 
DeepSeek MCP SDKs & servers 2026-10-16 03. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. 
Langflow MCP SDKs & servers 2026-10-05 04. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 05. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 06. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 07. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 08. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. 
Junie MCP SDKs & servers 2026-10-15 09. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 10. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 11. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 12. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 13. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 14. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 15. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 16. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 17. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 18. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 19. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 20. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 21. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 22. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 23. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. 
Cursor MCP SDKs & servers 2025-08 24. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers 
Supabase Cursor +1 more 2025-07-08 25. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 26. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 27. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 28. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 29. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 30. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 31. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15
Claude Code MCP SDKs & servers 2026-10-16 02. CVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npxDeepSeek Harness (dsh), DeepSeek's developer-preview agent harness, launches MCP servers by bare command name. Injected content can get the model to drop a fake executable into node_modules/.bin, which then runs every time that MCP server starts. DeepSeek MCP SDKs & servers 2026-10-16 03. Langflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)Langflow launched whatever command a user put in an MCP stdio server config, through bash -c, with no allowlist. Any user who could add an MCP server or build a flow could run OS commands on the Langflow host, and with the default auto-login no account was needed. Langflow MCP SDKs & servers 2026-10-05 04. CVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. MCP SDKs & servers 2026-03-31 05. CVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connectionsmcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL MCP SDKs & servers 2025-07-09 06. CVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxyVersions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests to launch MCP commands over stdio. MCP SDKs & servers 2025-06-13 07. CVE-2026-88755: Z.ai ZCode starts MCP servers from a repo's config the moment you open itZ.ai's ZCode desktop client 3.11.2.6792 connects to every MCP server declared in a repository's .zcode/config.json as soon as you open the folder, with no approval prompt. A cloned repo can run any command it likes on your machine. MCP SDKs & servers 2026-10-16 08. CVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP configOpening an untrusted project in Junie CLI before 26.8.3 could run code through the MCP server configuration that came with the project. Junie MCP SDKs & servers 2026-10-15 09. CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requestsMCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed. MCP SDKs & servers 2026-10-14 10. CVE-2026-108395: MCP Java SDK HTTP servers can be crashed with one huge requestThe official MCP Java SDK’s Servlet-based HTTP transports read the whole request body into memory with no size limit. One unauthenticated chunked POST can exhaust the Java heap and take the server down. MCP SDKs & servers 2026-10-14 11. CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverIn affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. MCP SDKs & servers 2026-10-06 12. CVE-2026-59950: MCP Python SDK: WebSocket server transport does not support Host/Origin validationIn affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. MCP SDKs & servers 2026-07-16 13. CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalIn affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. MCP SDKs & servers 2026-07-16 14. CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksIn affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. MCP SDKs & servers 2026-07-16 15. CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesWhile testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. MCP SDKs & servers 2026-03-31 16. CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP serversWhile testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. MCP SDKs & servers 2026-03-16 17. CVE-2026-25536: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseCross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments. MCP SDKs & servers 2026-02-04 18. CVE-2025-9611: Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server ToolsMicrosoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. MCP SDKs & servers 2026-01-07 19. CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityA ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp() function generates a regex pattern with nested quantifiers (([^/]+(?:,[^/]+))) for exploded template variables (e.g., {/id}, {?tags*}), causing catastrophic backtracking on malicious input. MCP SDKs & servers 2026-01-05 20. CVE-2025-66416: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 21. CVE-2025-66414: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultThe Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. MCP SDKs & servers 2025-12-02 22. CVE-2025-58444: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP ServerAn XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. MCP SDKs & servers 2025-09-08 23. CVE-2025-54136 (“MCPoison”): approved MCP servers could be silently swappedIn Cursor 1.2.4 and below, once you approved an MCP server, an attacker with write access could change its command without any re-prompt. Cursor MCP SDKs & servers 2025-08 24. Supabase MCP: a support ticket gets the agent to dump private tablesGeneral Analysis showed indirect prompt injection in support-ticket data making an MCP-connected assistant query private tables with Supabase’s privileged service role. MCP SDKs & servers Supabase Cursor +1 more 2025-07-08 25. CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoSA validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. MCP SDKs & servers 2025-07-04 26. CVE-2025-53365: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of ServiceIf a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. MCP SDKs & servers 2025-07-04 27. CVE-2025-53110: @modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefixVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files in cases where the prefix matches an allowed directory. Users are advised to upgrade to 2025.7.1 to resolve the issue. MCP SDKs & servers 2025-07-01 28. CVE-2025-53109: @modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handlingVersions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve. MCP SDKs & servers 2025-07-01 29. GitHub MCP server: a public issue makes the agent leak private reposInvariant Labs showed that a prompt injection planted in a public GitHub issue could get an agent using the official GitHub MCP server to pull data from the user’s private repositories. MCP SDKs & servers Claude Code Cursor +1 more 2025-05-26 30. MCP tool poisoning: hidden instructions in tool descriptionsAn MCP server can hide instructions inside a tool’s description. The model reads them, the user usually doesn’t, and the agent can be steered into reading files or sending data elsewhere. MCP SDKs & servers Cursor Claude Code +2 more 2025-04-01 31. CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion. MCP SDKs & servers 2026-10-15