CVE-2025-66416
published 2025-12-02CVE-2025-66416: The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol…
PriorityP350high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.45%
35.6th percentile
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jlowin | fastmcp | >= 0 < 2.14.0 | 2.14.0 |
| lfprojects | mcp_python_sdk | < 1.23.0 | 1.23.0 |
| lfprojects | mcp_python_sdk | >= 0 < 1.23.0 | 1.23.0 |
| mervinpraison | praisonaiagents | >= 0.6.0 < 1.6.59 | 1.6.59 |
| modelcontextprotocol | python-sdk | < 1.23.0 | 1.23.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.6HIGH
osv7.6HIGH
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
ghsa·2026-06-18
CVE-2025-66416 [HIGH] CWE-306 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
# PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
## Summary
`praisonaiagents.mcp.ToolsMCPServer.run_sse()` builds a Starlette MCP
HTTP+SSE server around `mcp.server.sse.SseServerTransport`. The server exposes
`/sse` and `/messages/`, but it does not validate `Origin`, does not validate
`Host`, and does not require any authentication.
This is reachable through supported PraisonAI code paths that wrap configured
MCP server tools and re-expose them over legacy SSE:
- `praisonai mcp run --transport sse`
- `praisonai serve mcp --name --transport sse`
- direct use of `ToolsMCPServer(...).run_sse(...)` or
`launch_tools_mcp_server(...
GHSA
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
ghsa·2025-12-26·CVSS 7.6
CVE-2025-66416 [HIGH] FastMCP updated to MCP 1.23+ due to CVE-2025-66416
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
OSV
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
osv·2025-12-26·CVSS 7.6
CVE-2025-66416 [HIGH] FastMCP updated to MCP 1.23+ due to CVE-2025-66416
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
OSV
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
osv·2025-12-02
CVE-2025-66416 [HIGH] Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description
The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security bes
GHSA
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
ghsa·2025-12-02
CVE-2025-66416 [HIGH] CWE-1188 Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description
The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security bes
Red Hat
mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
vendor_redhat·2025-12-02·CVSS 7.6
CVE-2025-66416 [HIGH] CWE-1188 mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note t
No detection rules found.
No public exploits indexed.
2025-12-02
Published