CVE-2026-52869

Analyzed Analyzed - Analysis Complete

Remote Code Execution in MCP Python SDK

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-52869

EUVD

EUVD-2026-44795

Affected Vendors & Products

Vendor	Product	Version / Range
lfprojects	mcp_python_sdk	to 1.27.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-52869 is a vulnerability in the MCP Python SDK versions before 1.27.2. It affects the SSE and stateful Streamable HTTP transports which route requests using only the session_id without verifying the authenticated principal who created the session. This allows an attacker with a known session ID to inject JSON-RPC messages into that session even if they use a different bearer token.

Detection Guidance

To detect this vulnerability, monitor for unauthorized JSON-RPC messages sent to active sessions using known session IDs. Check server logs for requests with mismatched bearer tokens and session IDs. Use network monitoring tools to inspect HTTP headers like Mcp-Session-Id for anomalies.

Impact Analysis

An attacker who obtains a session ID through logs or network observation could hijack a session, inject malicious JSON-RPC messages, and access sensitive data or perform unauthorized actions within that session. This bypasses per-client isolation, potentially leading to data breaches or unauthorized access to session resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of data protection and access control required by GDPR and HIPAA. It undermines session isolation and authentication mechanisms, potentially resulting in non-compliance with data security and privacy requirements.

Mitigation Strategies

Upgrade the MCP Python SDK to version 1.27.2 or later to address the session hijacking issue.
Review and monitor session IDs in logs or network traffic to detect unauthorized access attempts.
Ensure all MCP server deployments use authentication to leverage the principal binding feature introduced in the fix.

Hi! I’m here to help you understand CVE-2026-52869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70