[ Vendor · 9 CVEs ]
modelcontextprotocol
CVEs affecting modelcontextprotocol published in the last 30 days, plus any modelcontextprotocol CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111767 | 20 Oct 2026 | CVSS 8.6 | MCP TypeScript SDK: Experimental tasks were not tied to the session that created themMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the… | Fix |
| CVE-2026-109527 | 14 Oct 2026 | CVSS 7.5 | modelcontextprotocol python-sdkThe Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and… | |
| CVE-2026-108395 | 14 Oct 2026 | CVSS 7.5 | modelcontextprotocol io.modelcontextprotocol.sdk:mcpThe Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the… | |
| CVE-2026-59951 | 14 Oct 2026 | CVSS 6.9 | MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful… | Fix |
| CVE-2026-108714 | 11 Oct 2026 | CVSS 7.5 | modelcontextprotocol kotlin-sdkMCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because… | |
| CVE-2026-104850 | 6 Oct 2026 | CVSS 7.5 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions… | Fix |
| CVE-2026-104120 | 2 Oct 2026 | CVSS 7.3 | modelcontextprotocol mcp-server-fetchA security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the… | |
| CVE-2026-63127 | 16 Sep 2026 | CVSS 8.2 | modelcontextprotocol rust-sdkRMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in… | |
| CVE-2026-63128 | 16 Sep 2026 | CVSS 7.5 | modelcontextprotocol rust-sdkRMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in… |