CVE-2026-52869: modelcontextprotocol mcp authorization bypass in SSE and HTTP transports

Executive brief

The Model Context Protocol (MCP) Python SDK contains a security flaw in how it handles web-based communication sessions. An attacker who obtains a valid session ID can send unauthorized commands or intercept data from another user's session, even if they have different login credentials. This could lead to unauthorized data access or the ability to perform actions on behalf of other users in applications using this toolkit.

Technical details

An authorization bypass (CWE-639) exists in the SSE and Streamable HTTP server transports of the MCP Python SDK. The `mcp.server.sse.SseServerTransport` and `mcp.server.streamable_http_manager.StreamableHTTPSessionManager` components look up sessions using only the session identifier (via query parameters or headers) without validating the associated authentication principal (OAuth client ID, issuer, or subject). A network-based attacker with knowledge of a session UUID can inject JSON-RPC messages into that session or read responses. The vulnerability is mitigated in version 1.27.2, which implements principal verification for each session request.

Affected products

• Model Context Protocol (MCP) mcp <= 1.27.1

Timeline

• 2026-06-05: disclosed
• 2026-07-15: advisory: NVD publication date
• 2026-07-16: patched: GitHub Advisory published/updated with patch information

References

• https://api.github.com/users/srikanthramu
• https://github.com/srikanthramu
• https://api.github.com/users/srikanthramu/gists%7B/gist_id%7D
• https://api.github.com/users/srikanthramu/repos
• https://avatars.githubusercontent.com/u/8922182?v=4
• https://api.github.com/users/srikanthramu/events%7B/privacy%7D