CVE-2025-66416
published 2025-12-02CVE-2025-66416: The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol…
PriorityP350high8.1CVSS 3.1
AVNACLPRNUIRSUCHIHAN
EPSS
0.51%
42.6th percentile
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jlowin | fastmcp | >= 0 < 2.14.0 | 2.14.0 |
| lfprojects | mcp_python_sdk | < 1.23.0 | 1.23.0 |
| lfprojects | mcp_python_sdk | >= 0 < 1.23.0 | 1.23.0 |
| mervinpraison | praisonaiagents | >= 0.6.0 < 1.6.59 | 1.6.59 |
| modelcontextprotocol | python-sdk | < 1.23.0 | 1.23.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv4.07.6HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.6HIGH
osv7.6HIGH
vendor_redhat7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
ghsa·2026-06-18
CVE-2025-66416 [HIGH] CWE-306 PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
# PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
## Summary
`praisonaiagents.mcp.ToolsMCPServer.run_sse()` builds a Starlette MCP
HTTP+SSE server around `mcp.server.sse.SseServerTransport`. The server exposes
`/sse` and `/messages/`, but it does not validate `Origin`, does not validate
`Host`, and does not require any authentication.
This is reachable through supported PraisonAI code paths that wrap configured
MCP server tools and re-expose them over legacy SSE:
- `praisonai mcp run --transport sse`
- `praisonai serve mcp --name --transport sse`
- direct use of `ToolsMCPServer(...).run_sse(...)` or
`launch_tools_mcp_server(...
GHSA
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
ghsa·2025-12-26·CVSS 7.6
CVE-2025-66416 [HIGH] FastMCP updated to MCP 1.23+ due to CVE-2025-66416
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
OSV
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
osv·2025-12-26·CVSS 7.6
CVE-2025-66416 [HIGH] FastMCP updated to MCP 1.23+ due to CVE-2025-66416
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416.
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
OSV
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
osv·2025-12-02
CVE-2025-66416 [HIGH] Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description
The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security bes
GHSA
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
ghsa·2025-12-02
CVE-2025-66416 [HIGH] CWE-1188 Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description
The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances.
Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security bes
Red Hat
mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
vendor_redhat·2025-12-02·CVSS 7.6
CVE-2025-66416 [HIGH] CWE-1188 mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-66416 mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
bugzilla·2025-12-02·CVSS 8.1
CVE-2025-66416 [HIGH] CVE-2025-66416 mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
CVE-2025-66416 mcp: DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circum
Wiz
GHSA-rcfx-77hg-w2wv Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.7
CVE-2025-66416 [MEDIUM] GHSA-rcfx-77hg-w2wv Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-rcfx-77hg-w2wv :
Model Context Protocol vulnerability analysis and mitigation
There was a recent CVE report on MCP: https://nvd.nist.gov/vuln/detail/CVE-2025-66416 .
FastMCP does not use any of the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 did allow MCP SDK versions <1.23 that were vulnerable to CVE-2025-66416. Users should upgrade to FastMCP 2.14.0 or later.
Source : NVD
Published December 26, 2025
Severity HIGH
CNA Score N/A
Affected Technologies
Model Context Protocol
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
fastmcp
Sources
NVD
pip Severity HIGH Has F
2025-12-02
Published