Read the docs
TI-2026-37970 Aliases CVE-2026-52869GHSA-jpw9-pfvf-9f58

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Priority LOW 34CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00535 45th percentileScored 2026-11-07
Fix Fixed python-sdk (modelcontextprotocol): 1.27.2mcp (PyPI): 1.27.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowpython-sdkbefore 1.27.21.27.2Patch availableCNA
—mcp (PyPI)before 1.27.21.27.2Patch availableGHSA-jpw9-pfvf-9f58
  • python-sdk VendorMLflow Affected before 1.27.2 Fixed in 1.27.2 Patch available CNA
  • mcp (PyPI) Vendor— Affected before 1.27.2 Fixed in 1.27.2 Patch available GHSA-jpw9-pfvf-9f58

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*before 1.27.2VulnerableMLflow
  • cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:* Versions before 1.27.2 Vulnerable ·MLflow

Remediation

  • Fix · CNA python-sdk (modelcontextprotocol) Fixed in 1.27.2
  • Fix · GHSA-jpw9-pfvf-9f58 mcp (PyPI) Fixed in 1.27.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52869
  2. 2026-10-03 Alias added: GHSA-jpw9-pfvf-9f58

References

Patch 4

Advisory 2

Other 2

  • TI-2025-40852 DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost CVSS 4.0HIGH 7.6
  • TI-2026-42756 MCP Python SDK: WebSocket server transport does not support Host/Origin validation CVSS 4.0HIGH 7.6
  • TI-2026-37971 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences