Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mcp | pip | < 1.28.1 | 1.28.1 |
Miggo AIRoot Cause AnalysisThe analysis of the provided commit 777b8d06710c140e3606b0d4598e2aa48546c266 clearly indicates that the vulnerability was in the mcp.server.websocket.websocket_server function. The patch modifies this function to add Host and Origin header validation, which was previously missing. The vulnerability description explicitly names mcp.server.websocket.websocket_server as the affected component. The diff shows that before the patch, the function would immediately call await websocket.accept(subprotocol="mcp") without any checks. The patch introduces a call to security.validate_request(websocket, is_post=False) before accepting the connection, which mitigates the vulnerability. Therefore, any runtime profile of an exploited system would show the websocket_server function being called as it processes the malicious, unvalidated WebSocket connection.
websocket_serversrc/mcp/server/websocket.py