{"vulnerability": "cve-2026-52869", "sightings": [{"uuid": "60b5afb3-9ac8-4d14-a03e-45640281a8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52869", "type": "seen", "source": "https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb", "content": "# CVE-2026-52869: CVE-2026-52869: Session Hijacking and Authorization Bypass in Model Context Protocol (MCP) Python SDK\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52869\n\n## Summary\nAn authorization bypass vulnerability exists in the Model Context Protocol (MCP) Python SDK prior to version 1.27.2. The Server-Sent Events (SSE) and stateful Streamable HTTP transports route incoming JSON-RPC requests based purely on user-controlled session identifiers without validating ownership, enabling authenticated attackers to inject commands into other sessions.\n\n## TL;DR\nThe MCP Python SDK failed to bind active session identifiers to authenticated client principals, allowing any bearer-token-authenticated user to hijack and inject JSON-RPC messages into another client's session by supplying their session ID.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1 (High)\n- **Exploit Status**: poc\n- **Impact**: Authorization Bypass, Hijacking\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol (MCP) Python SDK (mcp PyPI package)\n- **mcp (PyPI)**: < 1.27.2 (Fixed in: `1.27.2`)\n\n## Mitigation\n\n- Upgrade Python mcp SDK to 1.27.2 or higher.\n- Configure custom authentication middleware to populate subject, client_id, and issuer claims.\n- Restrict trace and network logs to prevent exposure of active session UUIDs.\n\n**Remediation Steps:**\n1. Verify current package version via 'pip show mcp'.\n2. Execute 'pip install --upgrade mcp' to pull down 1.27.2+.\n3. Audit custom Starlette middleware implementations for compatibility with AuthenticatedUser constructs.\n4. Ensure experimental task management APIs use session-scoped generated IDs instead of global static task IDs.\n\n## References\n\n- [CVE-2026-52869 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-52869)\n- [GitHub Security Advisory GHSA-jpw9-pfvf-9f58](https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58)\n- [Official Release v1.27.2](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52869) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-16T20:31:08.551113Z"}]}