MetaMCP EUVD-2026-89362

Exploitable against default multi-tenant deployments of metatool-ai MetaMCP through version 2.4.22 where the MCP transport HTTP endpoints - including the unauthenticated GET /metamcp/health/sessions health route - are network-reachable. No authentication, credentials, or user interaction are required: the health endpoint hands out the active mcp-session-id values and namespace UUIDs that the attacker replays. The core defect is that getSession (session-lifetime-manager.ts) keys sessions solely on the client-supplied mcp-session-id header with no owner/namespace/endpoint binding, while the per-endpoint authorization middleware only checks the URL endpoint's owner and never the session. Limiting factors are minimal - realistic risk is bounded mainly by whether MetaMCP is deployed and its HTTP surface is exposed to the attacker, and by the presence of multiple tenants whose sessions are worth stealing.

All exploitability signals point to genuine high risk despite the absence of EPSS/KEV/POC data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description: the attack is network-reachable, low-complexity, and requires no authentication because the enabling primitive - GET /metamcp/health/sessions - discloses live session IDs and namespace UUIDs without any auth, which the attacker then replays in the mcp-session-id header. This is a complete, self-contained exploit chain (leak IDs, then impersonate) with no user interaction. C:H/I:H is well-justified: the attacker lists and executes a victim tenant's private MCP tools and exfiltrates data using the victim's own forwarded credentials; A:N is reasonable since the flaw is a confidentiality/integrity authorization bypass, not a service-disruption bug. No EPSS score, KEV listing, or public POC is present in the input - absence of these is NOT reassuring here because the chain is trivially reconstructable from the public advisory text. The one signal that dampens real-world risk is product footprint: MetaMCP is a niche MCP aggregator, so exploitation is likely targeted/opportunistic against the specific deployments that exist rather than widespread. Net: a real priority for anyone running MetaMCP <= 2.4.22, not a high-CVSS-but-low-real-risk paper cut.

An unauthenticated attacker on the network calls GET /metamcp/health/sessions to harvest a victim tenant's active mcp-session-id and namespace UUID, then issues MCP transport requests carrying that stolen session id in the mcp-session-id header. Because the session store is keyed only by that header with no owner/namespace binding, the attacker lists and invokes the victim's private MCP tools and exfiltrates data using the victim's forwarded upstream credentials. No public POC is identified, but the advisory describes the full chain and it is trivially reproducible.