[Git][security-tracker-team/security-tracker][master] Update status for some python-mcp issues

Fri Oct 16 15:45:15 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0fa0e64a by Salvatore Bonaccorso at 2026-10-16T16:10:07+02:00
Update status for some python-mcp issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2009,7 +2009,11 @@ CVE-2026-60010 (Gitea's repository-side team-link API allows a repository admini
 CVE-2026-60008 (Gitea's Jupyter notebook renderer inserts the notebook's language_info ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-59951 (The MCP Python SDK, called mcp on PyPI, is a Python implementation of  ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <unfixed>
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3395
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/3426
+	NOTE: Fixed by: https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7 (v1.30.0)
 CVE-2026-59774 (Gitea's Org-mode markup renderer processes INCLUDE directives supplied ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-59766 (Gitea's starred-repository and tracked-time API endpoints do not re-ch ...)
@@ -117911,7 +117915,10 @@ CVE-2026-62314 (Anubis is a Web AI Firewall Utility that challenges users' conne
 CVE-2026-62312 (9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows  ...)
 	NOT-FOR-US: 9Router
 CVE-2026-59950 (The MCP Python SDK, called mcp on PyPI, is a Python implementation of  ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp 1.28.1-1
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/pull/2992
+	NOTE: https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266 (v1.28.1)
 CVE-2026-56743 (Cilium is a networking, observability, and security solution. From 1.1 ...)
 	- cilium <itp> (bug #858303)
 CVE-2026-56742 (Cilium is a networking, observability, and security solution. Prior to ...)
@@ -117961,9 +117968,9 @@ CVE-2026-52888 (NocoBase is an AI-powered no-code/low-code platform for building
 CVE-2026-52887 (NocoBase is an AI-powered no-code/low-code platform for building busin ...)
 	NOT-FOR-US: NocoBase
 CVE-2026-52870 (The MCP Python SDK, called mcp on PyPI, is a Python implementation of  ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <not-affected> (Fixed before initial upload to Debian)
 CVE-2026-52869 (The MCP Python SDK, called mcp on PyPI, is a Python implementation of  ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <not-affected> (Fixed before initial upload to Debian)
 CVE-2026-51380 (Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) ...)
 	NOT-FOR-US: Tenda
 CVE-2026-50183 (WWBN AVideo is an open source video platform. Versions 29.0 and below  ...)
@@ -247351,7 +247358,7 @@ CVE-2025-66458 (Lookyloo is a web interface that allows users to capture a websi
 CVE-2025-66454 (Arcade MCP allows you to to create, deploy, and share MCP Servers. Pri ...)
 	NOT-FOR-US: Arcade MCP
 CVE-2025-66416 (The MCP Python SDK, called `mcp` on PyPI, is a Python implementation o ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <not-affected> (Fixed before initial upload to Debian)
 CVE-2025-66414 (MCP TypeScript SDK is the official TypeScript SDK for Model Context Pr ...)
 	NOT-FOR-US: MCP TypeScript SDK
 CVE-2025-66409 (ESF-IDF is the Espressif Internet of Things (IOT) Development Framewor ...)
@@ -296685,9 +296692,9 @@ CVE-2025-53603 (In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions
 CVE-2025-53602 (Zipkin through 3.5.1 has a /heapdump endpoint (associated with the use ...)
 	NOT-FOR-US: Zipkin
 CVE-2025-53366 (The MCP Python SDK, called `mcp` on PyPI, is a Python implementation o ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <not-affected> (Fixed before initial upload to Debian)
 CVE-2025-53365 (The MCP Python SDK, called `mcp` on PyPI, is a Python implementation o ...)
-	NOT-FOR-US: MCP Python SDK
+	- python-mcp <not-affected> (Fixed before initial upload to Debian)
 CVE-2025-48952 (NetAlertX is a network, presence scanner, and alert framework. Prior t ...)
 	NOT-FOR-US: NetAlertX
 CVE-2025-47228 (In the Production Environment extension in Netmake ScriptCase through  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0fa0e64aca6990057e9c0a88278943e43ec514de

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0fa0e64aca6990057e9c0a88278943e43ec514de
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/b8b72bd2/attachment-0001.htm>
