--- schema_version: '1.0' id: security-20260724-270802 url: https://osv.dev/vulnerability/PYSEC-2026-3482 url_hash: 27080219e1072988a3417edbfa1e6be65fb02268c7494efcadbb66e86d7a5733 canonical_url: https://osv.dev/vulnerability/PYSEC-2026-3482 source: osv:pypa category: security/library category_raw: cve/library region: null tags: - cve - CVE-2026-52869 - PYSEC-2026-3482 - severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L - mcp - PyPI lang: en published_at: '2026-07-23T11:41:46Z' fetched_at: '2026-07-24T07:01:54.524591Z' updated_at: '2026-07-24T07:02:21Z' status: published content_hash: a39f7cd9112adec60bb6f1f665208de12bfd23a58963150682ea32e848ded567 content_changed_at: null license_note: full summary: 'MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal' summary_source: rss summary_en: 'MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal' entities: - name: CVE-2026-44243 type: data - name: MCP type: concept - name: Python REPL type: UNKNOWN - name: HTTP_200_response type: event key_facts: [] related: [] related_auto: - name: 本人・法人認証 type: UNKNOWN weight: 1.0 - name: 監査ログ type: UNKNOWN weight: 1.0 - name: agent_d_bot type: person weight: 1.0 - name: agent_openclaw type: person weight: 1.0 title: 'CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal' --- # CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal ## TL;DR MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal ## Key Points - cve / CVE-2026-52869 / PYSEC-2026-3482 / severity:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L / mcp / PyPI ## Details **Severity:** CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L **Advisory:** PYSEC-2026-3482 (CVE-2026-52869) **Affected (your watchlist):** - `PyPI:mcp` 1.26.0 → fixed in 1.27.2 [docker/local+docker/mac] **Details:** ### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried. ### Am I affected? Only if a developer's application server uses an HTTP transport (SSE, or Streamable HTTP in stateful mode) **and** authenticates requests. Servers on stdio, stateless Streamable HTTP, or with no authentication configured are not affected. ### Details Both transports look up the target session by its identifier alone — the `session_id` query parameter for SSE (`mcp.server.sse.SseServerTransport`) and the `Mcp-Session-Id` header for Streamable HTTP (`mcp.server.streamable_http_manager.StreamableHTTPSessionManager`). Once the lookup succeeded, the request was handled on that session without comparing its authentication context to the credentials presented when the session was created, so a request authenticated as a different OAuth client could inject messages into the session. On the SSE transport the response is delivered to the original client's event stream; on the Streamable HTTP transport it is returned on the injecting request, so the injecting client can also read the result. The SSE transport has been affected since the first release; the Streamable HTTP transport since version 1.8.0. ### Impact Servers using either HTTP transport together with the SDK's built-in bearer-token authentication are affected: the per-client isolation that authentication provides can be bypassed for any session whose ID is known. Session IDs are randomly generated UUIDs, so exploitation requires obtaining one out of band (logs, network observation). Servers that do not enable bearer-token authentication have no per-client isolation to bypass and are not addressed by this advisory, and stateless Streamable HTTP deployments do not maintain sessions and are unaffected. ### Mitigation Upgrade to version 1.27.2 or later, which records the authenticated principal that created each session — the OAuth client ID together with the token's issuer and subject when the token verifier supplies them — and answers requests presenting a different principal with the same 404 response as for an unknown session. Deployments where many end users share a single OAuth client (hosted MCP clients, gateways) should ensure their token verifier populates `AccessToken.subject` (e.g. from the token's `sub` claim) so sessions are isolated per user rather than per client. Deployments using a custom authentication backend other than the built-in `BearerAuthBackend` should enforce an equivalent check themselves. **References:** - https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58 - https://nvd.nist.gov/vuln/detail/CVE-2026-52869 - https://github.com/modelcontextprotocol/python-sdk/pull/2690 - https://github.com/modelcontextprotocol/python-sdk/pull/2719 - https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00 - https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a - https://github.com/modelcontextprotocol/python-sdk - https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2 - https://pypi.org/project/mcp - https://github.com/advisories/GHSA-jpw9-pfvf-9f58 _Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-3482_ ## Source 元記事: [CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal](https://osv.dev/vulnerability/PYSEC-2026-3482) — published 2026-07-23T11:41:46Z