Log in Start free

Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-52869MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in python-sdk from modelcontextprotocol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPImcp1.27.2GHSA-jpw9-pfvf-9f58
PyPImcp1.27.2PYSEC-2026-3482

Affected products (as reported)

VendorProductVersions
modelcontextprotocol python-sdk < 1.27.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

References