modelcontextprotocol python-sdk up to 1.22.x insecure default initialization of resource

Summaryinfo

A vulnerability was found in modelcontextprotocol python-sdk up to 1.22.x. It has been rated as problematic. This affects an unknown function. Performing a manipulation results in insecure default initialization of resource. This vulnerability is cataloged as CVE-2025-66416. The attack must be initiated from a local position. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in modelcontextprotocol python-sdk up to 1.22.x. This affects an unknown function. The manipulation with an unknown input leads to a insecure default initialization of resource vulnerability. CWE is classifying the issue as CWE-1188. The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-66416 since 11/29/2025. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.23.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0120). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Red Hat Satellite

Productinfo

Type

• Programming Language Software

Vendor

• modelcontextprotocol

Name

• python-sdk

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22

Website

• Product: https://github.com/modelcontextprotocol/python-sdk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion