CVE-2026-52869
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in MCP Python SDK (mcp) before version 1.27.2 allows an attacker to inject JSON-RPC messages into an existing session. The issue affects SSE and Streamable HTTP transports, which do not verify the authenticated client's identity when using the session_id parameter or Mcp-Session-Id header.
Risk Assessment
An attacker with a known session ID can hijack another authenticated client's session, leading to unauthorized data access or operations performed in the victim's context.
Recommendation
Immediately update the mcp library to version 1.27.2 or later. In the meantime, restrict server access to trusted clients and monitor logs for suspicious sessions.
Other vulnerabilities in MCP Python SDK
See all- CVE-2026-59950High
A vulnerability in the MCP Python SDK (mcp) prior to version 1.28.1 affects the deprecated WebSocket transport, which did not validate Host or Origin headers. This allowed arbitrary third parties to establish WebSocket connections to applications using that transport.
- CVE-2026-52870High
A vulnerability in the MCP Python SDK (mcp) versions 1.23.0 through 1.27.2 allows any client to access other clients' tasks. Default handlers for task operations do not verify the session, enabling enumeration, reading results, consuming messages, or canceling tasks of other clients.
Original NVD description (English source)
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.