MCP Python SDK Vulnerability: WebSocket Server Transport Lacks Host/Origin Validation (CVE-2026-59950)
A vulnerability in the deprecated WebSocket server transport of the MCP Python SDK allows unauthenticated attackers to connect and issue JSON-RPC requests. Affected servers are those that expose `mcp.server.websocket.websocket_server` and lack proper authentication or origin validation. The vulnerability has a CVSS score of 7.6.