The affected boundary is a browser-to-service connection, not a model producing an unsafe answer. A page opened by the user can attempt a WebSocket connection to a reachable service. In the reported implementation, accepting that connection did not establish that the page was entitled to use the server. The capabilities exposed afterward determine the…
Inspect the ClaimsCase · DiggingBeagle record
A deprecated MCP WebSocket transport trusted the browser origin
A deprecated MCP WebSocket helper could let a hostile page reach a local agent server because it did not check Host or Origin. Version 1.28.1 adds the checks, but leaves them disabled unless the application supplies security settings.
Scope
Applications explicitly using the deprecated MCP Python SDK WebSocket helper: validation was absent before 1.28.1 and remains disabled after upgrading when security_settings is omitted. FastMCP, stdio, SSE and Streamable HTTP are outside this advisory.
Assessment profile
Assessment method- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Maintainer advisory checked on 1 October 2026. The fix requires application configuration, so this record does not label every upgraded deployment fixed. No in-the-wild exploitation or realized impact was established.
Assessed Oct 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-PATCH · CLM-SCOPE · CLM-ORIGIN · CLM-OPT-IN · MCP Python SDK deprecated WebSocket transport lacked Host and Origin validation · MCP 2025-11-25: Streamable HTTP transport security
At a glance
## Comparison and practical conclusion AutoJack also connected hostile web content with a local MCP control plane, but added an authentication bypass and server-parameter-to-process execution path. This advisory does not establish that additional chain. The shared lesson is narrower: a local endpoint still needs a decision about the caller and the…
Read the implicationsThe source set does not establish exploitation in the wild.
Limits and uncertaintyFull account
The affected boundary is a browser-to-service connection, not a model producing an unsafe answer. A page opened by the user can attempt a WebSocket connection to a reachable service. In the reported implementation, accepting that connection did not establish that the page was entitled to use the server. The capabilities exposed afterward determine the consequence: a narrow read-only service and a command-capable agent server do not present the same exposure.
Which deployments are in scope
The maintainer limits the advisory to applications that manually wired the deprecated mcp.server.websocket.websocket_server helper into an ASGI application. FastMCP, stdio, SSE and Streamable HTTP are explicitly excluded. Finding the mcp package in a lockfile is therefore not sufficient to classify a deployment as affected; the application must actually expose the relevant transport.
The repair has two parts
The important correction is operational: install a version that supports the checks, then enable and configure them. The patched helper still permits the old behavior when security_settings is omitted. A deployment inventory that records only a package version can consequently report an upgrade without establishing that the protection is active. Review the actual application initialization and test rejected origins, not merely the dependency file.
Why a local address is not an authorization decision
Loopback binding limits which network paths can reach a listener, but does not decide what a browser or another local client may ask it to do. Origin and Host checks help constrain browser-originated access, while authentication identifies an authorized client and tool authorization limits the client's actions. These checks address different questions and should not be treated as substitutes.
What is established and what is not
The advisory establishes the vulnerable code path and configuration-sensitive remediation. It does not establish exploitation in the wild, a victim count, or financial loss. This is not evidence that all MCP implementations are browser-exploitable, and no new exploit was executed during this review. The practical consequence should be evaluated against the actual listener, authentication policy and tools exposed by a particular installation.
Mechanism and trust boundary
- 01
Victim browses hostile content
A web origin can initiate connections from the victim browser.
Boundary: internet page / browser
- 02
Browser opens a WebSocket to local or LAN MCP service
The affected transport accepts the handshake without Host or Origin validation.
Boundary: browser / MCP transport
- 03
Connected client reaches MCP capabilities
What follows depends on the tools and authorization exposed by that server.
Boundary: transport / tool authority
Timeline
- Jul 7, 2026Event type unspecified
GitHub advisory published
The project discloses the Host/Origin validation gap.
- Jul 16, 2026Event type unspecified
Reviewed advisory updated
The GitHub Advisory Database record is updated.
Claims & evidence
CLM-PATCHVersion 1.28.1 adds optional Host/Origin validation for the deprecated WebSocket helper; the advisory lists it as patched but says applications must explicitly enable the settings.supported
Basis: reported finding · active
Material revision: Oct 1, 2026
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validationprimary disclosure
Patched versions
CLM-SCOPEThe advisory says the affected WebSocket transport was deprecated, not part of the MCP specification and not reachable through FastMCP; stdio, SSE and Streamable HTTP were not affected by this advisory.supported
Basis: reported finding · active
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validationprimary disclosure
Am I affected?
CLM-OPT-INThe advisory says version 1.28.1 leaves WebSocket Host/Origin validation disabled when security_settings is omitted; applications retaining the helper must configure TransportSecuritySettings explicitly.supported
Basis: reported finding
Material revision: Oct 1, 2026
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validationprimary disclosure
Remediation: security_settings defaults to None; configured TransportSecuritySettings
CLM-ORIGINBefore 1.28.1, the MCP Python SDK deprecated WebSocket server transport accepted handshakes without Host or Origin validation.supported
Basis: reported finding · active
- supportsMCP Python SDK deprecated WebSocket transport lacked Host and Origin validationprimary disclosure
Summary
Evidence visuals
diagram
Browser to deprecated MCP WebSocket transport
- Hostile web page
Runs in the victim browser
- Deprecated MCP WebSocket
Affected transport lacks Host/Origin validation
- MCP capabilities
Impact depends on exposed tools and authorization
- Hostile web page Deprecated MCP WebSocket: WebSocket handshake
- Deprecated MCP WebSocket MCP capabilities: MCP requests
Implications
Comparison and practical conclusion
AutoJack also connected hostile web content with a local MCP control plane, but added an authentication bypass and server-parameter-to-process execution path. This advisory does not establish that additional chain. The shared lesson is narrower: a local endpoint still needs a decision about the caller and the requested authority.
The MCP transport specification separates transport validation from authentication. Apply its requirements to the specified transport rather than retroactively treating the deprecated WebSocket helper as a standard MCP transport. A future deployment that combines unchecked browser access with more powerful tools could increase the consequences; that is a conditional architecture risk, not a reported new exploit.
Controls and mitigations
- Maintainer remediation: upgrade to 1.28.1 or a suitable supported version and explicitly supply TransportSecuritySettings with DNS-rebinding protection enabled and deployment-specific allowed hosts and origins; upgrading alone is insufficient.
- Maintainer direction: migrate away from the deprecated WebSocket helper where possible. Verify the security behavior of the replacement transport instead of assuming all transport defaults are identical.
- DiggingBeagle control recommendation: test untrusted Origin and Host values, enforce client authentication, and authorize individual tools separately. These are review recommendations, not an independently reproduced fix.
Unknowns and contradictions
- The source set does not establish exploitation in the wild.
Sources and citation
Material revision history
- Sep 16, 2026 · Published version · first publication · revision 2
- Oct 1, 2026 · Published version · material revision · revision 65Public fields changed: assessment_profile, claims, implications, mitigations, narrative, references, scope, summary