Race Condition within a Thread Affecting mcp-mesh package, versions [,0.5.6)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MCPMESH-14172361
- published4 Dec 2025
- disclosed2 Dec 2025
- creditUnknown
Introduced: 2 Dec 2025
CVE NOT AVAILABLE CWE-366 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade mcp-mesh to version 0.5.6 or higher.
Overview
mcp-mesh is a Kubernetes-native platform for distributed MCP applications
Affected versions of this package are vulnerable to Race Condition within a Thread due to a Race Condition in Access Control. The agent shutdown process fails to atomically remove agents from the registry before termination, leading to a window where terminated agents remain in the active registry, allowing unauthorized requests to be routed to or authenticated as non-existent agents.