CVE-2026-52869highCWE-639

CVE-2026-52869: falha de alta gravidade em modelcontextprotocol python-sdk

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar python-sdk+ Monitorar mcp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.5%
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
modelcontextprotocol · python-sdk
CVEs relacionadas — modelcontextprotocol python-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53366HIGHMCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of ServiceEPSS 9.8%CVE-2026-109527HIGHModel Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesEPSS 0.7%CVE-2025-66416HIGHDNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on LocalhostEPSS 0.5%CVE-2026-59951MEDIUMMCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionEPSS 0.5%CVE-2025-53365HIGHMCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of ServiceEPSS 0.4%CVE-2026-116685MEDIUMModel Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesEPSS 0.4%