strands_agents-1.50.2-py3-none-any.whl: 8 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - strands_agents-1.50.2-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

WS-2026-0089

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

In mcp (MCP Python SDK) 1.9.1 through 1.29.1 and 2.0.0a1 through 2.1.1, the OAuth client (mcp.client.auth) did not validate the authorization server metadata issuer on every discovery path and did not bind stored or pre-provisioned client credentials to their authorization server. A malicious or compromised MCP server could direct the client to a token endpoint of its choosing and receive the client_secret, authorization code and PKCE code_verifier (or a signed client assertion) meant for the real authorization server. Fixed in 1.30.0 and 2.2.0.

Publish Date: 2026-09-28

URL: WS-2026-0089

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-28

Fix Resolution: mcp - 1.30.0

CVE-2026-109527

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.

Publish Date: 2026-10-14

URL: CVE-2026-109527

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc

Release Date: 2026-10-14

Fix Resolution (mcp): 1.29.1

Direct dependency fix Resolution (strands-agents): 1.51.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2026-0133

Vulnerable Library - certifi-2026.7.22-py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/0b/a7/71ac2cff56fec219ed242bb11b8efb69fcc4bec75db06fb7bfe35de520e6/certifi-2026.7.22-py3-none-any.whl

Sample Path to Dependency File: /examples/plain-agents/weather-agent/pyproject.toml

Path to vulnerable library: /examples/plain-agents/weather-agent/.venv/lib/python3.12/site-packages/certifi-2026.7.22.dist-info,/examples/strands/code-assistant/.venv/lib/python3.12/site-packages/certifi-2026.7.22.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • httpx-0.28.1-py3-none-any.whl
    • ❌ certifi-2026.7.22-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

certifi 2019.03.09 through 2026.07.22 ships the "emSign ECC Root CA - G3" root certificate in its CA bundle (certifi/cacert.pem). Intermediates under this root were revoked for key compromise (cACompromise), so certificates issued with the compromised CA keys are trusted by applications that use certifi, enabling man-in-the-middle attacks. Fixed in 2026.10.18, which removed the root; 2026.10.19 restored the unaffected emSign roots and keeps G3 removed.

Publish Date: 2026-10-20

URL: WS-2026-0133

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-20

Fix Resolution (certifi): 2026.10.19

Direct dependency fix Resolution (strands-agents): 1.51.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-116684

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116684

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 1.30.0

CVE-2026-116686

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116686

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 1.30.0

CVE-2026-116685

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-27

URL: CVE-2026-116685

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-27

Fix Resolution: mcp - 1.30.0

CVE-2026-59951

Vulnerable Library - mcp-1.29.0-py3-none-any.whl

Model Context Protocol SDK

Library home page: https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/mcp-1.29.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ mcp-1.29.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.

Publish Date: 2026-10-14

URL: CVE-2026-59951

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-30

Fix Resolution: mcp - 1.30.0

CVE-2026-114603

Vulnerable Library - opentelemetry_api-1.44.0-py3-none-any.whl

OpenTelemetry Python API

Library home page: https://files.pythonhosted.org/packages/ca/6f/a04e900f465ff3221ccc395522503e2d10e79fa21f2723c8e177aae1e0d1/opentelemetry_api-1.44.0-py3-none-any.whl

Sample Path to Dependency File: /examples/strands/code-assistant/pyproject.toml

Path to vulnerable library: /examples/strands/code-assistant/.venv/lib/python3.12/site-packages/opentelemetry_api-1.44.0.dist-info

Dependency Hierarchy:

• strands_agents-1.50.2-py3-none-any.whl (Root Library)
  • ❌ opentelemetry_api-1.44.0-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: b0216e70661c252379f62ce3b52f0e85c3bfb8fa

Found in base branch: main

Vulnerability Details

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.

Publish Date: 2026-10-22

URL: CVE-2026-114603

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-22

Fix Resolution (opentelemetry-api): 1.45.1

Direct dependency fix Resolution (strands-agents): 1.51.0

⛑️ Automatic Remediation will be attempted for this issue.