StackRadar

CVE-2026-52870

High

Advisory

Published 16 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.6
base score, highest
EPSS
0.004
32nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
1 of 1
affected package

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
mcppypi1.25.0, 1.26.0, 1.27.0, 1.27.11.27.218
OSV records
GHSA-hvrp-rf83-w775
Also known as
PYSEC-2026-3481

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
mcp@1.26.0
1.27.2

Open the chart page →

2,133
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
mcp@1.26.0
1.27.2

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
mcp@1.26.0
1.27.2

Open the chart page →

4,634
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
mcp@1.26.0
1.27.2

Open the chart page →

2,133
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2

Open the chart page →

2,133
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mcp@1.27.1
1.27.2

Open the chart page →

4,601
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mcp@1.25.0
1.27.2

Open the chart page →

58,897
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
mcp@1.26.0
1.27.2

Open the chart page →

2,158
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
mcp@1.27.0
1.27.2

Open the chart page →

3,281
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
mcp@1.27.0
1.27.2

Open the chart page →

3,430
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
mcp@1.26.0
1.27.2

Open the chart page →

9,620
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mcp@1.26.0
1.27.2

Open the chart page →

8,405
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
mcp@1.26.0
1.27.2

Open the chart page →

2,444
plane-mcp-servermakeplaneVerified publisher1.0.01 of 2See more

plane-mcp-server makeplane 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
makeplane/plane-mcp-server:v0.3.071b7252adef0
mcp@1.26.0
1.27.2

Open the chart page →

2,552
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
mcp@1.27.1
1.27.2

Open the chart page →

1,672
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
mcp@1.27.0
1.27.2

Open the chart page →

2,555
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
mcp@1.27.1
1.27.2

Open the chart page →

3,707
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
mcp@1.25.0
1.27.2

Open the chart page →

5,201
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-52870.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
mcp@1.26.0
1.27.2

Open the chart page →

1,542

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
mcp@1.26.0
1.27.2
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
mcp@1.26.0
1.27.2
2
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
mcp@1.26.0
1.27.2
1
helmforge/fastmcp-server:0.2.061f759a1421f
mcp@1.27.0
1.27.2
1
helmforge/fastmcp-server:0.11.2fcb7017327d6
mcp@1.27.0
1.27.2
1
homeassistant/home-assistant:2026.75a531753cea9
mcp@1.26.0
1.27.2
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
mcp@1.25.0
1.27.2
1
makeplane/plane-mcp-server:v0.3.071b7252adef0
mcp@1.26.0
1.27.2
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
mcp@1.27.1
1.27.2
1
mindsdb/mindsdb:latest163011c09299
mcp@1.26.0
1.27.2
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
mcp@1.25.0
1.27.2
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
mcp@1.26.0
1.27.2
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
mcp@1.26.0
1.27.2
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
mcp@1.26.0
1.27.2
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
mcp@1.27.1
1.27.2
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
mcp@1.26.0
1.27.2
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
mcp@1.27.0
1.27.2
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
mcp@1.27.1
1.27.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.