What is the CVSS score of CVE-2026-52870?

CVE-2026-52870 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of MCP Python SDK are affected by CVE-2026-52870?

The MCP Python SDK (versions 1.23.0-1.27.1) contains a missing authorization vulnerability allowing authenticated clients to access and manipulate other users' tasks in multi-client server…. A patch is available.

How to fix or mitigate CVE-2026-52870?

Within 24 hours, identify all systems and services using the mcp PyPI package and document their current versions. Within 7 days, upgrade all affected instances (versions 1.23.0-1.27.1) to mcp version 1.27.2 or later, prioritizing production and multi-client server deployments. Within 30 days, conduct a retrospective audit of task histories and access logs for evidence of unauthorized cross-user access, implement enhanced monitoring for cross-client task operations, and document the incident for compliance and incident response records.

MCP Python SDK CVE-2026-52870

EUVD-2026-44797 HIGH

Missing Authorization (CWE-862)

2026-07-15 GitHub_M

GHSA-hvrp-rf83-w775

Authentication Bypass Python Python Sdk Modelcontextprotocol

7.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

7.6 HIGH

Attacker must be a connected client (PR:L) reaching the server over the network at low complexity (AV:N/AC:L); reading other tasks' results gives C:H while cancel/consume yields only I:L/A:L, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 15, 2026 - 22:33 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:33 vuln.today

Analysis Generated

Jul 15, 2026 - 20:33 vuln.today

CVE Published

Jul 15, 2026 - 20:07 cve.org

HIGH 7.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

15 pypi packages depend on mcp (8 direct, 7 indirect)

Ecosystem-wide dependent count for version 1.23.0.

DescriptionCVE.org

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.

Articles & Coverage 1

News 7 New Python Vulnerabilities - 7 High Severity, No Public POC Jul 16, 2026

AnalysisAI

Missing authorization in the MCP Python SDK (the mcp PyPI package) versions 1.23.0 through 1.27.1 lets any authenticated client of a multi-client server enumerate, read the results of, consume messages from, or cancel tasks belonging to other clients. The default handlers wired up by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel key solely on the task identifier and never bind a task to the session that created it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the upstream fix, deprecation warnings, and detailed advisory confirm the flaw; it is resolved in version 1.27.2.

Technical ContextAI

The Model Context Protocol (MCP) is the client/server protocol used to connect AI models to tools and data, and the mcp package is its reference Python implementation. The vulnerability lives in the experimental tasks subsystem enabled via server.experimental.enable_tasks(), which registers default JSON-RPC handlers for tasks/list, tasks/get, tasks/result, and tasks/cancel. These handlers operated purely on the opaque task identifier with no association to the originating session - the classic root cause of CWE-862 (Missing Authorization), where an action is performed without verifying the requester is entitled to the target object. The CPE cpe:2.3:a:modelcontextprotocol:python-sdk:*:*:*:*:*:*:*:* covers the affected implementation. The fix (PR #2720, commit 62137874) introduces a task_scope module and a per-session task_session_scope marker: run_task() now embeds this session marker into generated task IDs (scoped_task_id) so the default handlers can return 'task not found' for another session's task and omit it from tasks/list. Explicitly supplied task IDs are deprecated because they are used verbatim and remain unscoped/globally reachable.

RemediationAI

Vendor-released patch: upgrade the mcp package to version 1.27.2 or later, which binds generated task IDs to the creating session so the default handlers reject cross-session access (see the advisory GHSA-hvrp-rf83-w775 and release https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2, fix in PR https://github.com/modelcontextprotocol/python-sdk/pull/2720 and commit 62137874ff26dd74d2fea80ff528a7fd9ca7a5e7). If you cannot upgrade immediately, stop passing explicit task_id values to run_task() (these remain unscoped even after patching) and, for authorization tied to a user identity rather than a session, register custom handlers via @server.experimental.get_task(), @server.experimental.get_task_result(), @server.experimental.list_tasks(), and @server.experimental.cancel_task() instead of relying on the defaults. As a temporary compensating control, disable the experimental tasks feature (do not call enable_tasks()) or restrict the server to a single trusted client - the trade-off is loss of task functionality or multi-client support. Where explicit task IDs must be used, treat them as capabilities: generate them with high entropy, share only with the intended recipient, and use short TTLs.