StackRadarChart IndexLive demo

CVE-2026-59951

High

Advisory

Published 15 Oct 2026In the index since 16 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 43; of 18,137 indexed, latest versions
Container images: 40; deployed by those charts
Fix available: 1 of 1; affected package

MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Carried by container images the latest versions of 43 of 18,137 indexed charts deploy, on 40 images.

Affected package	Affected versions	Fixed in	Images
mcppypi	1.8.1, 1.9.4, 1.10.1, 1.12.2+9 more	1.30.0, 2.2.0	40

OSV records: GHSA-84m7-p3x7-pcfv

Charts affected

43 by stars

Chart

Latest

Affected images

Radar Score

home-assistanthelm-hass

1 of 1 See more

home-assistant helm-hass 0.3.86

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.1	130241f28d01	mcp@1.28.1	1.30.0

Open the chart page →

2,886

home-assistantalekc

1 of 1 See more

home-assistant alekc 2.12.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.1	130241f28d01	mcp@1.28.1	1.30.0

Open the chart page →

2,886

home-assistantandrenarchy

1 of 1 See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	mcp@1.26.0	1.30.0

Open the chart page →

3,326

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
baserow/backend :2.4.1	497347d0ba74	mcp@1.28.1	1.30.0

Open the chart page →

19,315

hermes-agenthermes-agent

1 of 1 See more

hermes-agent hermes-agent 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.9.24	fca358f12efd	mcp@2.0.0	2.2.0

Open the chart page →

7,136

home-assistanthome-assistant

1 of 3 See more

home-assistant home-assistant 0.5.13

1 of the 3 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.0	1b64d38f38d9	mcp@1.28.1	1.30.0

Open the chart page →

3,098

home-assistantk8s-home-lab-repo

1 of 1 See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	mcp@1.26.0	1.30.0

Open the chart page →

5,873

hermes-agentankra-charts

1 of 1 See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	mcp@2.0.0	2.2.0

Open the chart page →

7,819

home-assistantgabe565

1 of 1 See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :latest	3e6710a7ab2a	mcp@1.26.0	1.30.0

Open the chart page →

3,252

gentlemangentleman

1 of 1 See more

gentleman gentleman 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/madebyman/gentleman :0.4.0	2b143c89e662	mcp@2.1.1	2.2.0

Open the chart page →

1,539

langflow-idelangflow

1 of 2 See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	4304bd9e67db	mcp@1.28.1	1.30.0

Open the chart page →

4,916

langflow-runtimelangflow

1 of 1 See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	4304bd9e67db	mcp@1.28.1	1.30.0

Open the chart page →

544

litellmlitellm-helm

1 of 1 See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	mcp@1.10.1	1.30.0

Open the chart page →

4,818

home-assistantloeken-at-home

1 of 1 See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
loeken/home-assistant :2026.9.2	b1dff5b4c593	mcp@1.26.0	1.30.0

Open the chart page →

2,136

plane-enterprisemakeplane

1 of 13 See more

plane-enterprise makeplane 3.10.9

1 of the 13 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
makeplane/backend-commercial :v3.3.2	000b3ea7451a	mcp@1.28.1	1.30.0

Open the chart page →

6,700

home-assistantpree-helm-charts

1 of 1 See more

home-assistant pree-helm-charts 1.84.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.1	130241f28d01	mcp@1.28.1	1.30.0

Open the chart page →

2,886

akto-mini-testingakto

1 of 5 See more

akto-mini-testing akto 1.46.1

1 of the 5 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-ai-automated-testing :latest	573542399fe4	mcp@1.28.1	1.30.0

Open the chart page →

6,240

galaxycloudve

1 of 3 See more

galaxy cloudve 6.8.9

1 of the 3 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	mcp@1.27.1	1.30.0

Open the chart page →

7,571

csghubcsghub

2 of 35 See more

csghub csghub 2.6.0

2 of the 35 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	mcp@1.10.1	1.30.0
opencsghq/csgbot :v0.6.9-ee	7d0271e26521	mcp@1.25.0	1.30.0

Open the chart page →

67,811

1 of 10 See more

csgship csghub 0.4.7

1 of the 10 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
opencsghq/csgship-agentic :v0.4.0	2cd29671a03e	mcp@1.8.1	1.30.0

Open the chart page →

14,464

decisionrules-ocpdecisionrules-ocp

1 of 4 See more

decisionrules-ocp decisionrules-ocp 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
decisionrules/ai-engine :latest	b18f5190807b	mcp@1.29.0	1.30.0

Open the chart page →

1,777

home-assistantegeback

1 of 1 See more

home-assistant egeback 2.0.36

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.8.3	14931c6b1375	mcp@1.26.0	1.30.0

Open the chart page →

3,368

fastmcp-serverhelmforge

1 of 1 See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
helmforge/fastmcp-server :0.11.2	fcb7017327d6	mcp@1.27.0	1.30.0

Open the chart page →

3,970

hermes-agenthelmforge

1 of 1 See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.9.24	fca358f12efd	mcp@2.0.0	2.2.0

Open the chart page →

7,136

mcp-serverhelmforge

1 of 1 See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
helmforge/fastmcp-server :0.2.0	61f759a1421f	mcp@1.27.0	1.30.0

Open the chart page →

4,107

k8s-ai-srek8s-ai-sre

1 of 1 See more

k8s-ai-sre k8s-ai-sre 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
mohankrishna999/k8s-ai-agent :3.1.2	7f980f8c650c	mcp@1.29.0	1.30.0

Open the chart page →

1,030

graphiti-mcpkiberonlabs

1 of 1 See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
zepai/knowledge-graph-mcp :v0.2.1	6ab0ee79926b	mcp@1.9.4	1.30.0

Open the chart page →

3,865

mindsdbkronkltd

1 of 1 See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
mindsdb/mindsdb :latest	163011c09299	mcp@1.26.0	1.30.0

Open the chart page →

12,276

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	mcp@1.26.0	1.30.0

Open the chart page →

9,645

home-assistantlmatfy

1 of 1 See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2026.7	5a531753cea9	mcp@1.26.0	1.30.0

Open the chart page →

3,621

plane-mcp-servermakeplane

1 of 2 See more

plane-mcp-server makeplane 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
makeplane/plane-mcp-server :v0.3.0	71b7252adef0	mcp@1.26.0	1.30.0

Open the chart page →

3,420

mcp-atlassianmcp-helm

1 of 1 See more

mcp-atlassian mcp-helm 0.2.28

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/sooperset/mcp-atlassian :0.11.9	27c8e5b890e1	mcp@1.9.4	1.30.0

Open the chart page →

2,110

mcp-homeassistantmcp-helm

1 of 1 See more

mcp-homeassistant mcp-helm 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
voska/hass-mcp :latest	7142a431e2c5	mcp@1.29.0	1.30.0

Open the chart page →

12,114

mcpomcp-helm

1 of 1 See more

mcpo mcp-helm 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/mcpo :git-39b4867	f06525afac6b	mcp@1.12.2	1.30.0

Open the chart page →

5,031

memgraph-mcpmemgraph

1 of 1 See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
memgraph/mcp-memgraph :0.1.13	ecdf7faea3f7	mcp@1.27.1	1.30.0

Open the chart page →

2,122

parcelapp-mcpobeone

1 of 1 See more

parcelapp-mcp obeone 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/obeone/parcelapp-mcp :0.2.1	7073131db60b	mcp@2.1.1	2.2.0

Open the chart page →

1,278

octantisoctantis

1 of 1 See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/vinny1892/octantis :latest	45459c0910fc	mcp@1.27.0	1.30.0

Open the chart page →

3,096

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	92b8fab500f9	mcp@1.28.1	1.30.0

Open the chart page →

8,908

home-assistantpascaliske

1 of 1 See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	mcp@1.14.1	1.30.0

Open the chart page →

6,048

runwhen-localrunwhen-contrib

1 of 3 See more

runwhen-local runwhen-contrib 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/runwhen-contrib/runwhen-local :0.12.4	914e75d9f445	mcp@1.27.1	1.30.0

Open the chart page →

4,437

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	mcp@1.25.0	1.30.0

Open the chart page →

6,053

home-assistantsmall-hack

1 of 1 See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.3.1	0e091dfce306	mcp@1.26.0	1.30.0

Open the chart page →

5,116

srebotsrebot

1 of 2 See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-59951.

Container image	Digest	Package	Fixed in
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	mcp@1.26.0	1.30.0

Open the chart page →

1,840

Container images carrying it

40 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/home-assistant/home-assistant :2026.10.1	130241f28d01	mcp@1.28.1	1.30.0	3
langflowai/langflow :latest	4304bd9e67db	mcp@1.28.1	1.30.0	2
nousresearch/hermes-agent :v2026.9.24	fca358f12efd	mcp@2.0.0	2.2.0	2
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	mcp@1.26.0	1.30.0	1
baserow/backend :2.4.1	497347d0ba74	mcp@1.28.1	1.30.0	1
decisionrules/ai-engine :latest	b18f5190807b	mcp@1.29.0	1.30.0	1
helmforge/fastmcp-server :0.2.0	61f759a1421f	mcp@1.27.0	1.30.0	1
helmforge/fastmcp-server :0.11.2	fcb7017327d6	mcp@1.27.0	1.30.0	1
homeassistant/home-assistant :2026.7	5a531753cea9	mcp@1.26.0	1.30.0	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	mcp@1.25.0	1.30.0	1
loeken/home-assistant :2026.9.2	b1dff5b4c593	mcp@1.26.0	1.30.0	1
makeplane/backend-commercial :v3.3.1 :v3.3.2	000b3ea7451a	mcp@1.28.1	1.30.0	1
makeplane/plane-mcp-server :v0.3.0	71b7252adef0	mcp@1.26.0	1.30.0	1
memgraph/mcp-memgraph :0.1.13	ecdf7faea3f7	mcp@1.27.1	1.30.0	1
mindsdb/mindsdb :latest	163011c09299	mcp@1.26.0	1.30.0	1
mohankrishna999/k8s-ai-agent :3.1.2	7f980f8c650c	mcp@1.29.0	1.30.0	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	mcp@2.0.0	2.2.0	1
onyxdotapp/onyx-backend :latest	92b8fab500f9	mcp@1.28.1	1.30.0	1
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	mcp@1.10.1	1.30.0	1
opencsghq/csgbot :v0.6.9-ee	7d0271e26521	mcp@1.25.0	1.30.0	1
opencsghq/csgship-agentic :v0.4.0	2cd29671a03e	mcp@1.8.1	1.30.0	1
voska/hass-mcp :latest	7142a431e2c5	mcp@1.29.0	1.30.0	1
zepai/knowledge-graph-mcp :v0.2.1	6ab0ee79926b	mcp@1.9.4	1.30.0	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	mcp@1.10.1	1.30.0	1
ghcr.io/home-assistant/home-assistant :2026.3.1	0e091dfce306	mcp@1.26.0	1.30.0	1
ghcr.io/home-assistant/home-assistant :2026.8.3	14931c6b1375	mcp@1.26.0	1.30.0	1
ghcr.io/home-assistant/home-assistant :2026.10.0	1b64d38f38d9	mcp@1.28.1	1.30.0	1
ghcr.io/home-assistant/home-assistant :2026.9.4 :latest	3e6710a7ab2a	mcp@1.26.0	1.30.0	1
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	mcp@1.14.1	1.30.0	1
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	mcp@1.26.0	1.30.0	1
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	mcp@1.26.0	1.30.0	1
ghcr.io/madebyman/gentleman :0.4.0	2b143c89e662	mcp@2.1.1	2.2.0	1
ghcr.io/obeone/parcelapp-mcp :0.2.1	7073131db60b	mcp@2.1.1	2.2.0	1
ghcr.io/open-webui/mcpo :git-39b4867	f06525afac6b	mcp@1.12.2	1.30.0	1
ghcr.io/runwhen-contrib/runwhen-local :0.12.4	914e75d9f445	mcp@1.27.1	1.30.0	1
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	mcp@1.26.0	1.30.0	1
ghcr.io/sooperset/mcp-atlassian :0.11.9	27c8e5b890e1	mcp@1.9.4	1.30.0	1
ghcr.io/vinny1892/octantis :latest	45459c0910fc	mcp@1.27.0	1.30.0	1
public.ecr.aws/aktosecurity/akto-ai-automated-testing :latest	573542399fe4	mcp@1.28.1	1.30.0	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	mcp@1.27.1	1.30.0	1