SB20261109193 - Multiple vulnerabilities in MCP Python SDK

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-52870)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to read other clients' task results and cancel their tasks.

The vulnerability exists due to missing session ownership checks in the MCP Python SDK's default task handlers when a multi-client server calls server.experimental.enable_tasks(). A low-privileged remote attacker can enumerate tasks and retrieve queued elicitation payloads, preventing intended recipients from receiving those messages.

2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52869)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged remote attacker to inject JSON-RPC messages into another client's session.

The vulnerability exists due to missing principal verification when the MCP Python SDK's SSE and stateful Streamable HTTP transports route requests by session identifier with built-in bearer-token authentication enabled. A low-privileged remote attacker can use a session identifier obtained out of band with their own bearer token to bypass client isolation.

Remediation

Install update from vendor's website.

References

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58