CVE-2026-52870: Model Context Protocol Python SDK missing authorization in experimental tasks

CVE-2026-52870 · Severity: high · CVSS 7.6 · Published 2026-07-15

A vulnerability exists in the Python SDK for the Model Context Protocol (MCP), a framework used to connect AI models to data sources and tools. When an experimental task feature is enabled, the software fails to verify which user created a specific task before allowing actions on it. This allows any connected user to view, intercept, or cancel tasks belonging to other users, potentially exposing sensitive data or disrupting operations.

Technologies: Anthropic Model Context Protocol, Model Context Protocol MCP Python SDK, mcp (PyPI). Vendors: Anthropic, Model Context Protocol, PyPI.

Quick answers

Is CVE-2026-52870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52870 being exploited in the wild.
How severe is CVE-2026-52870?
High severity, with a CVSS score of 7.6, published 15 July 2026.
Which products and versions are affected?
Anthropic Model Context Protocol >= 1.23.0, <= 1.27.1; Model Context Protocol MCP Python SDK >= 1.23.0, < 1.27.2; mcp (PyPI) ECOSYSTEM:introduced=1.23.0,fixed=1.27.2.
Is there a fix for CVE-2026-52870?
Yes. mcp (PyPI): upgrade to 1.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52870 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-52870?
Check whether you run Anthropic Model Context Protocol, Model Context Protocol MCP Python SDK or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mcp (PyPI): upgrade to 1.27.2 or later
    pip install "mcp>=1.27.2"

Technical details

A missing authorization vulnerability (CWE-862) exists in the MCP Python SDK when the experimental tasks feature is enabled via 'server.experimental.enable_tasks()'. The default request handlers for 'tasks/list', 'tasks/get', 'tasks/result', and 'tasks/cancel' operate solely on task identifiers without verifying the session ownership of the task. A network-reachable attacker with basic client privileges can enumerate all active tasks, retrieve task results and elicitation payloads, and cancel tasks belonging to other sessions. The issue is resolved in version 1.27.2 by embedding per-session markers in task IDs and enforcing session-based filtering in the default handlers.

Affected products

  • Model Context Protocol (MCP) mcp >= 1.23.0, <= 1.27.1

Identifiers

  • CVE-2026-52870
  • GHSA-hvrp-rf83-w775
  • PYSEC-2026-3481

Timeline

  • 2026-06-05: disclosed: Initial report to maintainers
  • 2026-07-15: advisory: NVD publication date
  • 2026-07-16: patched: GitHub Advisory published and patch confirmed in v1.27.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.