What is the CVSS score of CVE-2026-55604?

CVE-2026-55604 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of DeepSeek MCP Server are affected by CVE-2026-55604?

arikusi DeepSeek MCP Server versions 1.4.2-1.6.x contain a session hijacking vulnerability in which the SessionStore accepts any caller-supplied session_id without authentication validation, allowing…. A patch is available.

Is there a public PoC exploit available for CVE-2026-55604?

Yes, a public proof-of-concept exploit is available for CVE-2026-55604. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-55604?

Within 24 hours: Identify and inventory all systems running arikusi DeepSeek MCP Server versions 1.4.2-1.6.x; isolate from production if operationally feasible. Within 7 days: Upgrade all instances to version 1.7.0 and perform functional testing. Within 30 days: Audit session logs for unauthorized access, notify affected users if hijacking is detected, and document remediation.

DeepSeek MCP Server CVE-2026-55604

EUVD-2026-42720 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-09 GitHub_M

GHSA-fh3r-g96v-f578

Authentication Bypass Deepseek Mcp Server

8.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.2 HIGH

Unauthenticated caller-controlled session_id (PR:N/AC:L) exposes victim conversations (C:H) and allows continuing them (I:L); no genuine availability impact, so A:N rather than the vendor's A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:05 vuln.today

DescriptionCVE.org

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied session_id values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via deepseek_sessions, then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.

AnalysisAI

Session context hijacking in the arikusi DeepSeek MCP Server (versions 1.4.2 through 1.6.x) lets remote attackers read and continue another user's DeepSeek V4 conversations. The process-global SessionStore trusts any caller-supplied session_id without tying it to an authenticated principal or transport session, so an attacker can enumerate live sessions via the deepseek_sessions tool and then replay a victim's session_id through deepseek_chat. No public exploit identified at time of analysis and it is not on CISA KEV, but the mechanics are trivial and fully described in the vendor advisory (GHSA-fh3r-g96v-f578); version 1.7.0 fixes it.

Technical ContextAI

The affected component is a Model Context Protocol (MCP) server (CPE cpe:2.3:a:arikusi:deepseek-mcp-server) that brokers chat requests to the DeepSeek V4 model and maintains multi-turn conversation state in an in-memory, process-wide SessionStore. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. an IDOR): session_id is a direct object reference chosen by the caller, and the server performs no ownership check binding that identifier to the authenticated user or the underlying transport (stdio/SSE/HTTP) connection that created it. Because the store is global to the process, every session is reachable by every caller, and the server even exposes an enumeration primitive (deepseek_sessions) that removes the need to guess identifiers.

RemediationAI

Vendor-released patch: upgrade to version 1.7.0 (https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0), which binds session identifiers to their owning principal/transport session. Until you can upgrade, do not expose the MCP server over a shared network transport (SSE/HTTP): run it locally over stdio bound to a single user so caller-supplied session_id values cannot cross trust boundaries, which limits functionality to one client but eliminates cross-user replay. If a shared deployment is unavoidable, place the server behind an authenticating reverse proxy that isolates each user and restrict access to the deepseek_sessions tool/endpoint so attackers cannot enumerate live session IDs. See the advisory GHSA-fh3r-g96v-f578 for specifics.