Executive brief
A vulnerability exists in the Python SDK for the Model Context Protocol (MCP), a framework used to connect AI models to data sources and tools. When an experimental task feature is enabled, the software fails to verify which user created a specific task before allowing actions on it. This allows any connected user to view, intercept, or cancel tasks belonging to other users, potentially exposing sensitive data or disrupting operations.
Technical details
A missing authorization vulnerability (CWE-862) exists in the MCP Python SDK when the experimental tasks feature is enabled via 'server.experimental.enable_tasks()'. The default request handlers for 'tasks/list', 'tasks/get', 'tasks/result', and 'tasks/cancel' operate solely on task identifiers without verifying the session ownership of the task. A network-reachable attacker with basic client privileges can enumerate all active tasks, retrieve task results and elicitation payloads, and cancel tasks belonging to other sessions. The issue is resolved in version 1.27.2 by embedding per-session markers in task IDs and enforcing session-based filtering in the default handlers.
Affected products
- Model Context Protocol (MCP) mcp >= 1.23.0, <= 1.27.1
Timeline
- 2026-06-05: disclosed: Initial report to maintainers
- 2026-07-15: advisory: NVD publication date
- 2026-07-16: patched: GitHub Advisory published and patch confirmed in v1.27.2