MCP Python SDK WebSocket Transport Missing Origin/Host Validation (CSWSH)
First seen Jul 16, 2026 · Updated Jul 16, 2026
The deprecated WebSocket transport in the MCP Python SDK accepted connections without validating Host or Origin headers, meaning any malicious webpage a victim's browser visits could open a WebSocket connection to a locally or network-exposed MCP server. This is a classic Cross-Site WebSocket Hijacking (CSWSH) pattern that could let an attacker-controlled origin interact with an MCP server's tools on behalf of an unwitting user. Severity is moderated because the affected transport is deprecated and impact depends on what the exposed server can do and whether it's reachable from a browser context.
Technical Analysis
The mcp.server.websocket.websocket_server transport in versions prior to 1.28.1 completes WebSocket handshakes without enforcing Host or Origin allowlists, so the SDK provided no built-in mechanism to restrict which web origins could establish a connection. An attacker hosting a malicious webpage could induce a victim's browser to open a WebSocket to a locally-bound or network-reachable MCP server, effectively using the browser as a confused deputy to bridge an untrusted origin into the agent's tool-calling interface. This crosses the browser-to-agent trust boundary: entry point is the browser rendering attacker content, and the gain is unauthorized invocation of MCP server tools/resources that the legitimate client would normally access, potentially leading to data exfiltration or unintended tool execution depending on server capabilities. The vulnerability is fixed in 1.28.1 by adding proper Host/Origin validation to the transport.
Affected Systems
mcp (MCP Python SDK); protocols: MCP
Detection Signatures
- WebSocket handshake logs showing connections from unexpected or missing Origin headers
- Connections to MCP server WebSocket endpoint from browser-originated third-party domains
- Absence of Origin/Host allowlist configuration in deployed MCP server config
- Use of mcp.server.websocket.websocket_server on mcp SDK versions < 1.28.1
Remediation Steps
- 1
Upgrade the MCP Python SDK
Update to mcp version 1.28.1 or later, which adds Host/Origin validation to the WebSocket transport.
- 2
Avoid the deprecated WebSocket transport
Migrate to actively maintained MCP transports (e.g., streamable HTTP) rather than the deprecated websocket_server module.
- 3
Enforce origin allowlisting at the network layer
If the WebSocket transport must be used, place a reverse proxy in front of it that validates Origin/Host headers before requests reach the MCP server.
- 4
Restrict network exposure
Bind MCP servers to localhost or internal networks only, and avoid exposing WebSocket MCP endpoints directly to browser-reachable network segments.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.