CVE-2026-52870
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability in the MCP Python SDK (mcp) versions 1.23.0 through 1.27.2 allows any client to access other clients' tasks. Default handlers for task operations do not verify the session, enabling enumeration, reading results, consuming messages, or canceling tasks of other clients.
Risk Assessment
The organization is at risk of sensitive data leakage and service disruption due to unauthorized access to other clients' tasks. An attacker could take control of tasks, compromising confidentiality and integrity.
Recommendation
Immediately update the MCP Python SDK to version 1.27.2 or later. After updating, verify the server configuration to ensure proper session-to-task assignment.
Other vulnerabilities in MCP Python SDK
See all- CVE-2026-59950High
A vulnerability in the MCP Python SDK (mcp) prior to version 1.28.1 affects the deprecated WebSocket transport, which did not validate Host or Origin headers. This allowed arbitrary third parties to establish WebSocket connections to applications using that transport.
- CVE-2026-52869High
A vulnerability in MCP Python SDK (mcp) before version 1.27.2 allows an attacker to inject JSON-RPC messages into an existing session. The issue affects SSE and Streamable HTTP transports, which do not verify the authenticated client's identity when using the session_id parameter or Mcp-Session-Id header.
Original NVD description (English source)
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.