Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-52869: The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP)

CVE-2026-52869 describes a session-hijacking flaw in the MCP Python SDK (PyPI package mcp) prior to version 1.27.2: the SSE and stateful Streamable HTTP transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header, without checking that the requesting principal matches the session's original authenticated bearer-token client. This lets a different authenticated client that learns or guesses a valid session ID inject JSON-RPC messages into another user's MCP session. CVSS 3.1 base score 7.1 (High); fixed in mcp 1.27.2.

TL;DR MCP Python SDK <1.27.2 lets any authenticated client with a known session_id inject JSON-RPC into another user's SSE/Streamable HTTP session (CVE-2026-52869, CWE-639).
Open original ↗

CVEs named here

  • CVE-2026-52869

Technologies named here

Techniques named here

  • Session hijacking via predictable/known session identifier

Related in AppSec