MCP Ruby SDK CVE-2026-67431

Exploitation requires the target to deploy MCP::Server::Transports::StreamableHTTPTransport from the mcp gem prior to 0.23.0 WITHOUT an application-supplied session_request_validator, and the attacker must first obtain a valid, non-expired session ID belonging to a victim (session-ID theft/leakage). Once that ID is held, no authentication is enforced by the transport itself (PR:N) and no user interaction is needed. Limiting factors: the CVSS 4.0 AT:P attack requirement means the ID must be acquired out-of-band; sessions expire on idle timeout; the built-in Origin check will block browser clients that present a mismatched Origin (but not curl/scripts that omit it); and deployments that already configured a session_request_validator or do not use the streamable HTTP transport are not exploitable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L) reflects a network-reachable, low-complexity attack with a real attack requirement (AT:P) - the attacker must first obtain a live session ID, which is the gating factor. Impact is integrity-centric (VI:H) with minor availability impact (VA:L) and no confidentiality impact per the vendor, consistent with executing actions rather than reading secrets. No EPSS score was supplied, there is no KEV listing, and no POC was provided, so real-world exploitation pressure appears low today; the primary risk is targeted session poisoning where an attacker can already intercept, capture a leaked, or otherwise obtain a session ID (e.g. logs, referer leakage, network position). The AT:P requirement meaningfully lowers practical risk versus a raw unauthenticated RCE, but consequences in a tool-calling context can be significant since tools/call may trigger real actions. Note the tension: the official vector rates PR:N (the transport itself requires no auth) even though exploitation depends on acquiring a session ID - treat the score as an upper bound conditioned on session-ID exposure.

An attacker who captures a victim's session ID - via leaked logs, a network position, or referer/URL exposure - sends a crafted tools/call POST to the streamable HTTP endpoint carrying that session ID. Because pre-0.23.0 transport only checks that the session exists and is not idle-expired, the request executes within the victim's session, letting the attacker invoke tools or cancel the victim's in-flight requests (notifications/cancelled). No public exploit was provided, and success is contingent on first obtaining a valid session ID (CVSS AT:P).