Technical impact
The MCP Python SDK, distributed on PyPI as mcp, implements the Model Context Protocol. In versions prior to 1.28.1 the deprecated websocket_server transport accepted WebSocket handshakes without performing Host or Origin header validation. This omission means that any WebSocket client can establish a connection to an application that exposes this transport, bypassing any application‑level origin restrictions. The weakness is consistent with CWE-1385 for missing validation and CWE-346 for insecure handling of external input.
Affected Systems
Users of the Model Context Protocol Python SDK who run versions earlier than 1.28.1 are affected, specifically those using the deprecated websocket_server transport. The issue is limited to the SDK; the host application may not check origins, leaving the choice to the SDK.
Risk and Exploitability
The CVSS score of 7.6 signals high severity. An EPSS score of less than 1% indicates a low probability of exploitation currently, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploiting the vulnerability requires network access to the host that exposes the websocket_server endpoint. If an attacker can reach the endpoint, they can initiate a WebSocket handshake without Host or Origin checks, which could be used to connect to unauthorized services or exfiltrate data depending on the application’s logic.
Github GHSA