MCP SDKs
Filed as: Model Context Protocol, MCP TypeScript SDK, mcp gem, Model Context Protocol Python SDK, RMCP, mcp, MCP Python SDK, MCP Inspector, MCP Java SDK, Model Context Protocol TypeScript SDK, @modelcontextprotocol/sdk, Go MCP SDK, and 5 more
Newest record 2026-11-05 · 39 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Exploited or KEV-listed · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for MCP SDKs has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
Disclosed CVEs, no confirmed exploitation · 40
- closed7.7MCP SDKs CVE-2026-111770: Model Context Protocol TypeScript SDK Multi-Client Message Routing Flaw
Disclosed · since 5 Nov 2026 · CVE-2026-111770
AI - closed6.8MCP SDKs CVE-2026-116684: Model Context Protocol Python SDK resource-confusion authentication flaw
Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116684
AI - closed6.5MCP SDKs CVE-2026-116686: Model Context Protocol Python SDK SSRF and local file read via schema resolution
Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116686
AI - closed5.9MCP SDKs CVE-2026-116685: Model Context Protocol Python SDK credential leakage via redirects
Disclosed · Patched · since 27 Oct 2026 · CVE-2026-116685
AI - closed7.5MCP SDKs MCP TypeScript SDK lacks request body size and batch length limits
Disclosed · since 27 Oct 2026
AI - closed7.5MCP SDKs CVE-2026-111768: MCP TypeScript SDK suffered from request validation memory exhaustion
Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111768
AI - closed6.8MCP SDKs CVE-2026-111771: MCP TypeScript SDK accepted bearer tokens issued for other services
Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111771
AI - closed6.5MCP SDKs CVE-2026-111769: MCP TypeScript client SDK leaked custom headers on cross-origin redirects
Disclosed · since 20 Oct 2026 · updated 5 Nov 2026 · CVE-2026-111769
AI - closed8.6MCP SDKs CVE-2026-111767: MCP TypeScript SDK experimental tasks lacked session isolation
Disclosed · since 20 Oct 2026 · CVE-2026-111767
AI - closed7.5MCP SDKs Model Context Protocol Python SDK Unbounded Session Accumulation Flaw
Disclosed · since 14 Oct 2026 · updated 15 Oct 2026 · CVE-2026-59951
AI - closed7.5MCP SDKs Model Context Protocol Java SDK Unbounded Request Body Vulnerability
Disclosed · since 14 Oct 2026 · CVE-2026-108395
AI - closed7.5MCP SDKs Model Context Protocol Python SDK Unbounded HTTP Body Memory Buffer Vulnerability
Disclosed · since 14 Oct 2026 · CVE-2026-109527
AI - closed7.5MCP SDKs MCP TypeScript SDK OAuth Client Credential Exposure Vulnerability
Disclosed · since 6 Oct 2026 · CVE-2026-104850
AI - closed7.5MCP SDKs CVE-2026-63128: RMCP Streamable HTTP server session leak
Disclosed · since 16 Sep 2026 · CVE-2026-63128
AI - closed8.2MCP SDKs CVE-2026-63127: RMCP OAuth metadata validation flaw
Disclosed · since 16 Sep 2026 · CVE-2026-63127
AI - closed6.8MCP SDKs RMCP Rust SDK Leaks Custom Headers on Cross-Origin Redirects
Disclosed · since 16 Sep 2026 · CVE-2026-64684
AI - closed6.2MCP SDKs MCP Kotlin SDK vulnerable to buffer growth denial of service
Disclosed · since 9 Sep 2026 · CVE-2026-53937
AI - closed8.7MCP SDKs CVE-2026-53965: MCP PHP SDK unbounded memory buffer vulnerability
Disclosed · since 25 Aug 2026 · CVE-2026-53965
AI - closed6.2MCP SDKs CVE-2026-63119: Unbounded IO Read Vulnerability in MCP Ruby SDK
Disclosed · since 29 Jul 2026 · CVE-2026-63119
AI - closed7.5MCP SDKs CVE-2026-67432: Unbounded JSON-RPC Request Vulnerability in MCP Ruby SDK
Disclosed · since 29 Jul 2026 · CVE-2026-67432
AI - closed5.3MCP SDKs CVE-2026-67430: Memory Exhaustion Vulnerability in MCP Ruby SDK
Disclosed · since 29 Jul 2026 · CVE-2026-67430
AI - closed8.3MCP SDKs CVE-2026-67431: Session Hijacking Vulnerability in MCP Ruby SDK
Disclosed · since 29 Jul 2026 · CVE-2026-67431
AI - closed6.9MCP SDKs CVE-2026-63118: DNS Rebinding Vulnerability in MCP Ruby SDK
Disclosed · since 29 Jul 2026 · CVE-2026-63118
AI - closed7.6MCP SDKs CVE-2026-59950: MCP Python SDK WebSocket server lacks Host and Origin validation
Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-59950
AI - closed7.1MCP SDKs CVE-2026-52869: MCP Python SDK HTTP transports fail to verify authenticated principal
Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-52869
AI - closed7.6MCP SDKs CVE-2026-52870: MCP Python SDK experimental task handlers allow unauthorized task access
Disclosed · since 16 Jul 2026 · updated 16 Jul 2026 · CVE-2026-52870
AI - closed9.4MCP SDKs CVE-2026-11624: Model Context Protocol lacks Origin header validation allowing DNS rebinding
Disclosed · since 13 Jun 2026 · CVE-2026-11624
AI - closed8.8MCP SDKs CVE-2026-42559: RMCP Streamable HTTP Server Host Header Validation Flaw
Disclosed · since 14 May 2026 · CVE-2026-42559
AI - closed7.6MCP SDKs CVE-2026-35568: DNS rebinding vulnerability in MCP Java SDK
Disclosed · since 7 Apr 2026 · CVE-2026-35568
AI - closed8.1MCP SDKs CVE-2026-34742: DNS Rebinding Vulnerability in Go MCP SDK
Disclosed · since 2 Apr 2026 · CVE-2026-34742
AI - closed6.1MCP SDKs CVE-2026-34237: Hardcoded Wildcard CORS Vulnerability in MCP Java SDK
Disclosed · since 31 Mar 2026 · CVE-2026-34237
AI - closed8.2MCP SDKs CVE-2026-33946: MCP Ruby SDK session hijacking vulnerability
Disclosed · since 27 Mar 2026 · CVE-2026-33946
AI - closed7.1MCP SDKs CVE-2026-25536: Model Context Protocol SDK cross-client data leak
Disclosed · since 4 Feb 2026 · CVE-2026-25536
AI - closed8.7MCP SDKs CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Disclosed · since 5 Jan 2026 · CVE-2026-0621
AI - closed7.6MCP SDKs CVE-2025-66416: MCP Python SDK lacks default DNS rebinding protection
Disclosed · since 2 Dec 2025 · updated 26 Dec 2025 · CVE-2025-66416
AI - closed7.6MCP SDKs CVE-2025-66414: MCP TypeScript SDK lacks default DNS rebinding protection
Disclosed · since 2 Dec 2025 · CVE-2025-66414
AI - closed8.6MCP SDKs CVE-2025-58444: MCP Inspector Vulnerable to Command Execution via XSS
Disclosed · since 8 Sep 2025 · CVE-2025-58444
AI - closed8.7MCP SDKs CVE-2025-53366: MCP Python SDK FastMCP Server Denial of Service Vulnerability
Disclosed · since 4 Jul 2025 · CVE-2025-53366
AI - closed8.7MCP SDKs CVE-2025-53365: MCP Python SDK Denial of Service via Streamable HTTP Transport
Disclosed · since 4 Jul 2025 · CVE-2025-53365
AI - closed9.4MCP SDKs CVE-2025-49596: MCP Inspector Authentication Bypass and RCE
Disclosed · since 13 Jun 2025 · CVE-2025-49596
AI
Other incidents: research and unexploited reports · 5
- liveMCP SDKs MCP Tool Poisoning in Agentic AI Frameworks Across Multiple Frameworks
Research · since 3 Nov 2026 · updated 5 Nov 2026
AI - closedMCP SDKs Log-To-Leak: Prompt injection attacks on tool-using LLM agents via MCP
Research · since 28 Oct 2026
AI - closedMCP SDKs Cross-modal steganographic prompt injection targeting Model Context Protocol agents
Research · since 26 Oct 2026
AI - closedMCP SDKs Credential Exfiltration via Remote Poisoned MCP Tool
Research · since 1 Apr 2025
AI - closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI
Fix status and fixed versions are recorded when a source states them (each record’s page shows what is known); check the vendor’s own advisory before acting.