StackRadar

CVE-2026-52869

High

Advisory

Published 16 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
mcppypi1.1.2, 1.8.1, 1.9.4, 1.10.1+5 more1.27.224
OSV records
GHSA-jpw9-pfvf-9f58
Also known as
PYSEC-2026-3482

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
mcp@1.26.0
1.27.2

Open the chart page →

2,133
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
mcp@1.26.0
1.27.2

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
mcp@1.26.0
1.27.2

Open the chart page →

4,634
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
mcp@1.26.0
1.27.2

Open the chart page →

2,133
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
mcp@1.10.1
1.27.2

Open the chart page →

4,292
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2

Open the chart page →

2,133
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mcp@1.27.1
1.27.2

Open the chart page →

4,601
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
mcp@1.10.1
1.27.2
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mcp@1.25.0
1.27.2

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
mcp@1.8.1
1.27.2

Open the chart page →

11,335
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
mcp@1.26.0
1.27.2

Open the chart page →

2,158
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
mcp@1.1.2
1.27.2

Open the chart page →

4,647
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
mcp@1.27.0
1.27.2

Open the chart page →

3,281
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
mcp@1.27.0
1.27.2

Open the chart page →

3,430
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
mcp@1.9.4
1.27.2

Open the chart page →

3,393
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
mcp@1.26.0
1.27.2

Open the chart page →

9,620
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mcp@1.26.0
1.27.2

Open the chart page →

8,405
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
mcp@1.26.0
1.27.2

Open the chart page →

2,444
plane-mcp-servermakeplaneVerified publisher1.0.01 of 2See more

plane-mcp-server makeplane 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
makeplane/plane-mcp-server:v0.3.071b7252adef0
mcp@1.26.0
1.27.2

Open the chart page →

2,552
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
mcp@1.27.1
1.27.2

Open the chart page →

1,672
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
mcp@1.27.0
1.27.2

Open the chart page →

2,555
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
mcp@1.14.1
1.27.2

Open the chart page →

4,749
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
mcp@1.27.1
1.27.2

Open the chart page →

3,707
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
mcp@1.25.0
1.27.2

Open the chart page →

5,201
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-52869.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
mcp@1.26.0
1.27.2

Open the chart page →

1,542

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
mcp@1.26.0
1.27.2
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2
2
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mcp@1.26.0
1.27.2
1
helmforge/fastmcp-server:0.2.061f759a1421f
mcp@1.27.0
1.27.2
1
helmforge/fastmcp-server:0.11.2fcb7017327d6
mcp@1.27.0
1.27.2
1
homeassistant/home-assistant:2026.75a531753cea9
mcp@1.26.0
1.27.2
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
mcp@1.25.0
1.27.2
1
makeplane/plane-mcp-server:v0.3.071b7252adef0
mcp@1.26.0
1.27.2
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
mcp@1.27.1
1.27.2
1
mindsdb/mindsdb:latest163011c09299
mcp@1.26.0
1.27.2
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
mcp@1.10.1
1.27.2
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mcp@1.25.0
1.27.2
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
mcp@1.8.1
1.27.2
1
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
mcp@1.9.4
1.27.2
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
mcp@1.10.1
1.27.2
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
mcp@1.1.2
1.27.2
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
mcp@1.26.0
1.27.2
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
mcp@1.26.0
1.27.2
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
mcp@1.14.1
1.27.2
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
mcp@1.26.0
1.27.2
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
mcp@1.27.1
1.27.2
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
mcp@1.26.0
1.27.2
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
mcp@1.27.0
1.27.2
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mcp@1.27.1
1.27.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.