After a stretch of quiet mornings, the week's action lands on the MCP layer — and this time at its foundation. The official MCP Python SDK ships fixes for three separate high-severity advisories: a WebSocket transport that never validated Host or Origin, and two auth gaps in the HTTP transport where a known session ID reaches another client's session or tasks. If you expose a Python MCP server over HTTP or WebSocket, 1.28.1 is the floor that closes all three. The highest number on the board sits elsewhere — n8n-MCP at a clean 9.9 for cross-tenant reads of workflow backups — beside a critical in websocket-driver (9.2), the sort of npm dependency your Node tree pulls in without being asked. On the .NET side, July's Patch Tuesday carried an 8.8 elevation-of-privilege in the ASP.NET Core Negotiate handler across .NET 8, 9, and 10. Everything here has a fixed release.

Worth your morning

MCP Python SDK — three highs, 1.28.1 closes them. The official Python SDK behind a large share of MCP servers patched three separate issues. CVE-2026-59950 (7.6) is a WebSocket transport that shipped without the Host/Origin check, so a page a user visits could open a connection to a reachable MCP server and enumerate or call its tools. CVE-2026-52869 (7.1) and CVE-2026-52870 (7.6) are HTTP-transport auth gaps: with auth enabled, a caller who knows a session ID can act on that session, and connected clients can read or cancel other clients' tasks. 1.27.2 fixed the two HTTP issues; 1.28.1 adds the WebSocket fix, so 1.28.1 is the version to land on. Servers running stdio on your own machine aren't reached by any of it — anything exposed over HTTP or WebSocket wants the upgrade today.

n8n-MCP — the top number, a specific shape. CVE-2026-54052 (9.9): in multi-tenant HTTP deployments, an authenticated tenant could read workflow version snapshots belonging to other tenants — and those snapshots can carry credential references and authorization headers. A companion moderate (CVE-2026-55608) exposes default-scope backups the same way. Both close in 2.56.1. Single-tenant or non-HTTP setups aren't the target, but if you run n8n-MCP for more than one tenant, upgrade and treat any exposed snapshots as leaked.

websocket-driver — the dependency you didn't pick. CVE-2026-54466 (9.2) is a length-header parsing flaw that corrupts message framing — a data-integrity break in a package that sits underneath a lot of Node WebSocket stacks as a transitive dependency. 0.7.5 is the fix. Run npm ls websocket-driver to see whether it's in your tree; odds are it is.

ASP.NET Core — Negotiate handler, 8.8. For the .NET stack, the July 14 servicing release closes an elevation-of-privilege in the ASP.NET Core Negotiate authentication handler (CVE-2026-47303, with companion CVE-2026-47300), affecting .NET 8, 9, and 10 through improper credential parsing. Fixed in the 8.0.29 / 9.0.18 / 10.0.10 runtimes; if you deploy on the aspnet container images, rebuild on the July tags.

Rounding out the AI side: tensorzero (CVE-2026-54457, 7.7) exposed an internal object-storage endpoint that honoured a caller-supplied storage path, reading files and reaching internal addresses it shouldn't — fixed in 2026.6.0; and @andrea9293/mcp-documentation-server (CVE-2026-54504, 8.8), a documentation MCP server whose web UI bound to every interface with no auth, left its knowledge base open to anyone on the network — fixed in 1.13.1, and bind it to localhost while you're in there.