high CVSS 8.1

CVE-2025-66416·Python vulnerability

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.23.0, tThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured TransportSecuritySettings, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. Note that running HTTP-based MCP servers locally without authentication is not recommended per MCP security best practices. This issue does not affect servers using stdio transport. This vulnerability is fixed in 1.23.0.

Severity
high
Software
Python
Fixed in
1.23.0
Published
2025-12-02

Affected versions

Until: 1.23.0

Fixed in: 1.23.0

How to fix this CVE

Update the MCP Python SDK to version 1.23.0 or later to enable DNS rebinding protection by default. This fix is critical for environments running HTTP-based MCP servers on localhost without authentication, especially when using FastMCP with streamable HTTP or SSE transport. Ensure TransportSecuritySettings are properly configured after patching to strengthen your security posture.

sudo dnf update python3-mcp || pip3 install --upgrade mcp>=1.23.0

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET / HTTP/1.1
Host: localhost:port
Origin: http://attacker-controlled-domain.com
Referer: http://attacker-controlled-domain.com/
Content-Type: application/json

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement DNS rebinding protection at the network level by validating the Host header against a whitelist of expected values. Block requests where the Host header contains localhost or 127.0.0.1 originating from non-local sources. Configure your WAF to deny cross-origin requests to localhost endpoints without proper CORS headers and authentication tokens.

How to check if you are affected

  1. Run `python3 -c "import mcp; print(mcp.__version__)"` to determine the installed MCP SDK version on each system.
  2. Check for FastMCP server instances with HTTP/SSE transport: `ps aux | grep fastmcp` or `grep -r 'fastmcp' /opt/ /srv/ /home/ --include='*.py' 2>/dev/null`.
  3. Examine application logs for unusual HTTP requests to localhost from external origins by searching for DNS rebinding patterns: `grep -E '(Host: localhost|127\.0\.0\.1)' /var/log/*/access.log /var/log/*/error.log 2>/dev/null | grep -v '^127\.' | head -20`.
  4. Verify the fix by running `pip3 show mcp | grep Version` and confirming the version is 1.23.0 or higher.

FAQ

What is CVE-2025-66416?

CVE-2025-66416 is a DNS rebinding vulnerability in the MCP Python SDK that allows attackers to bypass same-origin policy restrictions and send unauthorized requests to local HTTP-based MCP servers without authentication. This could lead to attackers invoking tools or accessing resources exposed by the server.

Is CVE-2025-66416 being actively exploited?

No, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are currently available. However, the technical barrier to exploitation is low once the DNS rebinding protection gap is understood.

What versions of Python MCP SDK are affected by CVE-2025-66416?

All versions of the MCP Python SDK prior to version 1.23.0 are affected. Versions 1.23.0 and later include DNS rebinding protection by default.

How do I check if my server is vulnerable to CVE-2025-66416?

Run `pip3 show mcp | grep Version` to check the installed MCP SDK version. If the version is below 1.23.0, your system is vulnerable. Additionally, verify if you are running HTTP-based MCP servers on localhost without authentication using `ps aux | grep -i mcp` or checking your application configuration files.

Does Defensia detect CVE-2025-66416?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If the MCP Python SDK is installed on a monitored server, CVE-2025-66416 will appear in your dashboard with remediation steps.

Related Python CVEs

CVE-2026-33054CVSS 10Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily target files on the disk under the standard file-based runtime backend. This can result in application denial of service (via crash loops when reading non-msgpack target files as configurations), or arbitrary file manipulation. This vulnerability heavily exposes systems hosted utilizing FileStateSessionBackend. Unauthorized malicious actors could interact with arbitrary payloads overwriting or explicitly removing underlying service resources natively outside the application bounds. This issue has been fixed in version 1.2.3.
CVE-2026-34938CVSS 10PraisonAI is a multi-agent teams system. Prior to version 1.5.90, execute_code() in praisonai-agents runs attacker-controlled Python inside a three-layer sandbox that can be fully bypassed by passing a str subclass with an overridden startswith() method to the _safe_getattr wrapper, achieving arbitrary OS command execution on the host. This issue has been patched in version 1.5.90.
CVE-2026-25632CVSS 10EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom deserializer (my_load_from_json) that supports a type field. When type is present, the deserializer dynamically imports an attacker-specified module/class and instantiates it with attacker-supplied arguments. This allows invoking dangerous classes such as subprocess.Popen, which can lead to OS command execution during JSON parsing. This also affects the loading of JSON files. This vulnerability is fixed in 0.16.1.
CVE-2026-28505CVSS 10Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the compiled code object. However, co_names only contains names from the outer code object. When a lambda expression is used, it creates a nested code object whose attribute accesses are stored in code.co_consts, NOT in code.co_names. The sandbox never inspects nested code objects. This issue has been patched in version 2.17.0.
CVE-2026-25115CVSS 9.9n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated users to break out of the Python sandbox environment and execute code outside the intended security boundary. This issue has been patched in version 2.4.8.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-66416. Free for 1 server.

Get started free