EUVD-2026-44795
GHSA-jpw9-pfvf-9f58
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Attacker needs their own valid bearer token (PR:L) plus knowledge of a victim's transient, non-controllable session ID (AC:H) over the network (AV:N); injecting into another session breaches confidentiality and integrity (C:H/I:H) with limited availability impact (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 279 pypi packages depend on mcp (144 direct, 139 indirect)
Ecosystem-wide dependent count for version 1.27.2.
DescriptionCVE.org
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.
Articles & Coverage 1
AnalysisAI
Cross-session message injection in the MCP Python SDK (the 'mcp' package on PyPI) prior to 1.27.2 allows an authenticated client holding a valid bearer token to hijack another principal's session on the SSE and stateful Streamable HTTP transports. Because SseServerTransport and StreamableHTTPSessionManager route inbound requests using only the session_id query parameter or Mcp-Session-Id header - never checking that the caller is the same authenticated principal who created the session - any bearer-token-authenticated client who learns a victim's session ID can inject arbitrary JSON-RPC messages into that session. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in version 1.27.2.
Technical ContextAI
The Model Context Protocol (MCP) is a JSON-RPC-based protocol that lets LLM applications talk to tool/context servers. The Python SDK implements two long-lived, stateful HTTP transports: the legacy Server-Sent Events (SSE) transport (mcp.server.sse.SseServerTransport) and the newer Streamable HTTP transport managed by mcp.server.streamable_http_manager.StreamableHTTPSessionManager. Both maintain server-side session state keyed by a session identifier that the client echoes back on each request - via the session_id query parameter (SSE) or the Mcp-Session-Id header (Streamable HTTP). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key, an IDOR-style flaw): the session lookup trusts the client-supplied key alone and never binds the session to the authenticated OAuth/bearer principal (the RFC 7662/9068 'sub' subject) that established it. The affected component is cpe:2.3:a:modelcontextprotocol:python-sdk. The fix (PRs #2690 and #2719, commits 1abcca24 and ce267b6f) threads a 'subject' claim through the auth provider chain - AuthorizationCode, RefreshToken, and AccessToken now carry the resource-owner subject plus additional claims - so the server can associate and verify the principal that owns each session.
RemediationAI
Vendor-released patch: 1.27.2. Upgrade the 'mcp' PyPI package to version 1.27.2 or later, which binds sessions to the authenticated principal by propagating the OAuth subject through the token and session chain (per GHSA-jpw9-pfvf-9f58, PRs #2690 and #2719); this is the primary and recommended fix. If you cannot upgrade immediately, reduce exposure by avoiding shared multi-principal use of the stateful transports: run a separate server process or endpoint per authenticated principal so a session ID from one tenant cannot be replayed against another, or switch to stateless Streamable HTTP mode where feasible (trade-off: loses server-side session continuity and any features that depend on it). Additionally treat session IDs as secrets - ensure they are high-entropy, transmitted only over TLS, and never logged or leaked via Mcp-Session-Id headers or session_id parameters - but note this only raises the bar and does not close the authorization gap, since a colluding or compromised bearer client can still obtain and reuse an ID. See the release notes at https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2 and the advisory at https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today