Version 1.28.1 is listed as the patched MCP Python SDK release for CVE-2026-59950.
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validation
Locator: Patched versions
The advisory lists 1.28.1 as patched.
Case · DiggingBeagle record
A deprecated MCP WebSocket transport trusted the browser origin
CVE-2026-59950 covered a deprecated MCP Python SDK WebSocket transport that did not validate Host or Origin, leaving local or LAN MCP servers exposed to cross-origin browser access when developers wired that transport themselves.
Deprecated MCP Python SDK WebSocket server transport before 1.28.1. FastMCP, stdio, SSE and Streamable HTTP are outside this advisory.
- First seen
- Jul 7, 2026
- Case kind
- vulnerability
- AI role
- AGAINST AI
- Claims
- 3
Reconstruction
The vulnerability sits at the transport boundary rather than in a model. A browser page can initiate a WebSocket handshake to a local or LAN service. If the service does not validate where that browser request came from, the user's browser can become a bridge from hostile web content to a privileged MCP endpoint.
The advisory is narrower than a generic claim that MCP is browser-exploitable. The affected transport was deprecated, was not part of the MCP specification and required developers to wire it directly into an ASGI application. Applications using FastMCP did not reach this code path.
The patch in 1.28.1 adds the missing security handling. The broader lesson matches AutoJack and Windows-MCP: a service being local does not make the browser origin trustworthy.
Mechanism & boundary
- 01
Victim browses hostile content
A web origin can initiate connections from the victim browser.
Boundary: internet page / browser
- 02
Browser opens a WebSocket to local or LAN MCP service
The affected transport accepts the handshake without Host or Origin validation.
Boundary: browser / MCP transport
- 03
Connected client reaches MCP capabilities
What follows depends on the tools and authorization exposed by that server.
Boundary: transport / tool authority
Timeline
- Jul 7, 2026
GitHub advisory published
reportThe project discloses the Host/Origin validation gap.
- Jul 16, 2026
Reviewed advisory updated
followupThe GitHub Advisory Database record is updated.
Claims & evidence
The advisory says the affected WebSocket transport was deprecated, not part of the MCP specification and not reachable through FastMCP; stdio, SSE and Streamable HTTP were not affected by this advisory.
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validation
Locator: Am I affected?
The advisory limits exposure to applications that explicitly wired mcp.server.websocket.websocket_server into an ASGI application.
Before 1.28.1, the MCP Python SDK deprecated WebSocket server transport accepted handshakes without Host or Origin validation.
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validation
Locator: Summary
The advisory says TransportSecuritySettings was not wired into the deprecated WebSocket transport.
Evidence visuals
diagram
Browser to deprecated MCP WebSocket transport
- Hostile web page
Runs in the victim browser
- Deprecated MCP WebSocket
Affected transport lacks Host/Origin validation
- MCP capabilities
Impact depends on exposed tools and authorization
- Hostile web page Deprecated MCP WebSocket: WebSocket handshake
- Deprecated MCP WebSocket MCP capabilities: MCP requests
Implications
Local agent control planes need transport security that assumes hostile browser content. Host and Origin validation are controls, not substitutes for authentication and tool authorization.
Controls & mitigations
- Upgrade to mcp 1.28.1 or later if the deprecated WebSocket transport is used.
- Do not expose deprecated local transports merely because they bind to loopback or a LAN.
- Use explicit authentication and authorization in addition to origin and host validation.
What remains unknown
- The source set does not establish exploitation in the wild.
Cite this record
DiggingBeagle. “A deprecated MCP WebSocket transport trusted the browser origin.” First seen Jul 7, 2026. https://diggingbeagle.com/cases/a-deprecated-mcp-websocket-transport-trusted-the-browser-origin/
Citation guidance