MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
Priority HIGH 75CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Spoofing, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-384 and CWE-639.
Summary
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00474 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ruby-sdk (modelcontextprotocol): 0.9.2mcp (RubyGems): 0.9.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | ruby-sdk | before 0.9.2 | 0.9.2 | Patch available | CNA |
| — | mcp (RubyGems) | before 0.9.2 | 0.9.2 | Patch available | GHSA-qvqr-5cv7-wh35 |
- ruby-sdk VendorMLflow Affected before 0.9.2 Fixed in 0.9.2 Patch available CNA
- mcp (RubyGems) Vendor— Affected before 0.9.2 Fixed in 0.9.2 Patch available GHSA-qvqr-5cv7-wh35
Remediation
- Fix · CNA ruby-sdk (modelcontextprotocol) Fixed in 0.9.2
- Fix · GHSA-qvqr-5cv7-wh35 mcp (RubyGems) Fixed in 0.9.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33946
- 2026-10-03 Alias added: GHSA-qvqr-5cv7-wh35
References
Patch 5
- https://github.com/modelcontextprotocol/ruby-sdk/commit/db40143402d65b4fb6923cec42d2d72cb89b3874
- https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L93-L97
- https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2
- https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685
- https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
Sources
- CVE-2026-33946 · CVE Program
- CVE-2026-33946 · NVD
- FIRST EPSS
- GHSA-qvqr-5cv7-wh35 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences