---
schema_version: '1.0'
id: security-20260717-f4f0b5
url: https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58
url_hash: f4f0b536bb3d5ca68e1cec63177cd7d4faeb1d6751ff1f3f90bdad4b803145d0
canonical_url: https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58
source: osv:ghsa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2026-52869
- GHSA-jpw9-pfvf-9f58
- severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
- mcp
- PyPI
lang: en
published_at: '2026-07-16T19:58:53Z'
fetched_at: '2026-07-17T06:48:04Z'
updated_at: '2026-07-17T06:48:38Z'
status: published
content_hash: 971c8faf115b617022d5208aed5bab6f253a6fdd4a394076ff216fa10f474229
license_note: full
summary: 'MCP Python SDK: HTTP transports serve session requests without verifying
  the authenticated principal'
summary_source: rss
summary_en: 'MCP Python SDK: HTTP transports serve session requests without verifying
  the authenticated principal'
entities:
- name: MCP
  type: concept
- name: python
  type: method
- name: https://deploymentsafety.openai.com/gpt-5-6/gpt-5-6.pdf
  type: artifact
key_facts: []
related: []
related_auto:
- name: 構造化接続
  type: concept
  weight: 1.0
title: 'CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without
  verifying the authenticated principal'
---

# CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

## TL;DR
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

## Key Points
- cve / CVE-2026-52869 / GHSA-jpw9-pfvf-9f58 / severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L / mcp / PyPI

## Details
**Severity:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
**Advisory:** GHSA-jpw9-pfvf-9f58 (CVE-2026-52869)

**Affected (your watchlist):**
- `PyPI:mcp` 1.26.0 → fixed in 1.27.2 [docker/local+docker/mac]

**Details:**
### Summary
In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried.

### Am I affected?
Only if a developer's application server uses an HTTP transport (SSE, or Streamable HTTP in stateful mode) **and** authenticates requests. Servers on stdio, stateless Streamable HTTP, or with no authentication configured are not affected.

### Details
Both transports look up the target session by its identifier alone — the `session_id` query parameter for SSE (`mcp.server.sse.SseServerTransport`) and the `Mcp-Session-Id` header for Streamable HTTP (`mcp.server.streamable_http_manager.StreamableHTTPSessionManager`). Once the lookup succeeded, the request was handled on that session without comparing its authentication context to the credentials presented when the session was created, so a request authenticated as a different OAuth client could inject messages into the session. On the SSE transport the response is delivered to the original client's event stream; on the Streamable HTTP transport it is returned on the injecting request, so the injecting client can also read the result. The SSE transport has been affected since the first release; the Streamable HTTP transport since version 1.8.0.

### Impact
Servers using either HTTP transport together with the SDK's built-in bearer-token authentication are affected: the per-client isolation that authentication provides can be bypassed for any session whose ID is known. Session IDs are randomly generated UUIDs, so exploitation requires obtaining one out of band (logs, network observation). Servers that do not enable bearer-token authentication have no per-client isolation to bypass and are not addressed by this advisory, and stateless Streamable HTTP deployments do not maintain sessions and are unaffected.

### Mitigation
Upgrade to version 1.27.2 or later, which records the authenticated principal that created each session — the OAuth client ID together with the token's issuer and subject when the token verifier supplies them — and answers requests presenting a different principal with the same 404 response as for an unknown session.

Deployments where many end users share a single OAuth client (hosted MCP clients, gateways) should ensure their token verifier populates `AccessToken.subject` (e.g. from the token's `sub` claim) so sessions are isolated per user rather than per client. Deployments using a custom authentication backend other than the built-in `BearerAuthBackend` should enforce an equivalent check themselves.

**References:**
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58
- https://nvd.nist.gov/vuln/detail/CVE-2026-52869
- https://github.com/modelcontextprotocol/python-sdk/pull/2690
- https://github.com/modelcontextprotocol/python-sdk/pull/2719
- https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00
- https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a
- https://github.com/modelcontextprotocol/python-sdk
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2

_Data: OSV.dev (upstream: ghsa) — https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58_

## Source
元記事: [CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal](https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58) — published 2026-07-16T19:58:53Z