Plango
Get Plango

For developers

Mac security

← AI agent vulnerabilities

CVE-2026-52869

MCP Python SDK

7.1
Severity
High
Published
July 15, 2026
Last modified
July 17, 2026

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.

CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness

References

CVE-2026-52869 on NVD

Listed in

HighMCP servers

More MCP Python SDK CVEs

Oct 14
CVE-2026-599516.9

Stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count…

 Jul 15
CVE-2026-599508.1

The deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could…

 Jul 15
CVE-2026-528707.6

Default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each…

 Dec 2
CVE-2025-664168.1

TThe Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers.

 Jul 4
CVE-2025-533668.7

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted.

 Jul 4
CVE-2025-533658.7

If a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a…