EUVD-2026-50501
GHSA-5p9g-j988-pcwv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must first obtain a valid session ID out-of-band; PR:N as the transport enforces no auth; I:H for tool execution in the victim's session, C:N and A:L per vendor.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that execute in the victim's session. This issue is fixed in version 0.23.0.
AnalysisAI
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tools/call requests that execute inside the victim's session, because StreamableHTTPTransport validates only session existence and idle timeout without binding a session to its owner. Affected deployments are those exposing the streamable HTTP transport; the flaw enables cross-session action execution and in-flight request tampering (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to deploy MCP::Server::Transports::StreamableHTTPTransport from the mcp gem prior to 0.23.0 WITHOUT an application-supplied session_request_validator, and the attacker must first obtain a valid, non-expired session ID belonging to a victim (session-ID theft/leakage). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L) reflects a network-reachable, low-complexity attack with a real attack requirement (AT:P) - the attacker must first obtain a live session ID, which is the gating factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who captures a victim's session ID - via leaked logs, a network position, or referer/URL exposure - sends a crafted tools/call POST to the streamable HTTP endpoint carrying that session ID. Because pre-0.23.0 transport only checks that the session exists and is not idle-expired, the request executes within the victim's session, letting the attacker invoke tools or cancel the victim's in-flight requests (notifications/cancelled). … |
| Remediation | Vendor-released patch: 0.23.0 - upgrade the mcp gem to 0.23.0 or later (fix commit 35466605319a34e4c7808712ae9bb1ca1afb2356). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a full application inventory to identify all deployments running mcp gem versions before 0.23.0 with StreamableHTTPTransport enabled, and assess criticality of each deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthent
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust se
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today