Insufficiently Protected Credentials

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client authentication flow, where the SEP-235...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/client is a Model Context Protocol implementation for TypeScript - Client package Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the fetchToken and discardIfIssuerMismatch functions in the OAuth client authentication flo...

Insufficiently Protected Credentials

Overview @modelcontextprotocol/server-legacy is a Frozen v1 SSE transport and OAuth Authorization Server helpers for the Model Context Protocol TypeScript SDK. Deprecated; use StreamableHTTP and a dedicated OAuth server in production. Affected versions of this package are vulnerable to...

PT-2026-106775

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.12.0 through 1.30.1 @modelcontextprotocol/client versions 2.0.0 through 2.1.0 Description The SDK's OAuth client support allows an MCP server to determine which authorization server receives the client's...

CVE-2026-104850: Insufficient Verification of Data Authenticity

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

GHSA-C9XM-49CP-XCR9 rmcp OAuth client fetches server-controlled resource_metadata URLs

Summary The rmcp OAuth client accepts a server-controlled resourcemetadata= URL from the WWW-Authenticate header and fetches it without same-origin or private-network validation. An attacker-controlled MCP server can return a 401 WWW-Authenticate: Bearer resourcemetadata="..." header pointing at ...

CVE-2026-104120

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

CVE-2026-104120

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

CVE-2026-104120

A server-side request forgery (SSRF) vulnerability exists in the modelcontextprotocol components mcp-server-fetch and mcp-server-everything up to version 2026.6.4 . The flaw is located in the fetch_url function within the file mcp_server_fetch/server.py of the Fetch Tool component. An attacker ca...

CVE-2026-104120 modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

EUVD-2026-91161

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

WS-2026-0090

In @modelcontextprotocol/sdk 1.24.0 through 1.31.0, the experimental tasks feature taskStore did not check which session created a task: InMemoryTaskStore ignored the sessionId, so clients sharing one InMemoryTaskStore on an HTTP server could list, read and cancel each other's tasks and receive...

PT-2026-104071

Name of the Vulnerable Software and Affected Versions mcp-server-fetch versions prior to 2026.6.4 mcp-server-everything versions prior to 2026.6.4 Description A server-side request forgery SSRF issue exists in the Fetch Tool component. The vulnerability occurs within the fetch url function locate...

CVE-2026-104120: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

21millionpixels-mcp (>=0.2.0, <=0.2.1), @0xkillaflow/agama-redmine-mcp (>=1.0.0, <=2.1.0) +5179 more potentially affected by unknown CVE via @modelcontextprotocol/sdk (>=1.24.0, <=1.31.0)

@modelcontextprotocol/sdk NPM version =1.24.0, =0.2.0, =1.0.0, =0.1.3, =0.1.0, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =8.0.0, =0.14.0, =0.1.0, =0.2.0, =0.7.0, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0090...

CVE-2026-63127

creationtimestamp| type| source ---|---|--- 2026-09-17 00:35:09+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj 2026-09-17 03:31:23+00:00| seen| https://gist.github.com/alon710/16597bd55d59e6c89394c487c227381c...

PT-2026-64814

Root has patched AIKIDO-2025-10459 in the @rootio/modelcontextprotocol sdk package for Root:npm. Multiple fixed versions available...

GO-2026-5658 MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry

MCP Registry has open redirect via protocol-relative path in trailing-slash middleware in github.com/modelcontextprotocol/registry...

MAL-2026-5481 Malicious code in mcp-server-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0b86cc4cf49b5d6cda37126f6a0c7c9f9fec648eb4d4743b6f39423613d3122 Package squats the unscoped name mcp-server-postgres impersonating the official scoped MCP postgres server. package.json declares "postinstall": "nod...

GO-2026-5008 MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry

MCP Registry: OCI validator skips ownership check on upstream rate limits in github.com/modelcontextprotocol/registry...