CVE-2026-79537

CriticalCVSS 9.1

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

IDOR vulnerability in MetaMCP up to 2.4.22 in MCP transport. Sessions are keyed only by client-supplied mcp-session-id header without owner binding, and /metamcp/health/sessions discloses active session IDs. An attacker can use another tenant's session to execute private MCP tools and exfiltrate data.

Risk Assessment

An attacker can access another tenant's private tools and data, leading to confidentiality and integrity breaches.

Recommendation

Update MetaMCP to a version after 2.4.22 and implement session-owner binding and session-level authorization.

Other vulnerabilities in MetaMCP

CVE-2026-79538Critical
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).

Original NVD description (English source)

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint's owner, never the session. An attacker who supplies another tenant's session id " obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs " can list and execute the victim tenant's private MCP tools and exfiltrate their data using the victim's forwarded credentials.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS