CVE-2026-67431: modelcontextprotocol ruby-sdk session hijacking in StreamableHTTPTransport

Executive brief

The Ruby SDK for the Model Context Protocol (MCP) contains a vulnerability where it fails to verify the ownership of active sessions. An attacker who obtains a valid session ID can send unauthorized commands to the server, causing the server to execute tools on behalf of the victim. This can lead to unauthorized data modification or state changes within the victim's session without their knowledge.

Technical details

A session poisoning vulnerability exists in the `StreamableHttpTransport` and SSE implementation of the Ruby MCP SDK. The root cause is a lack of validation binding session IDs to specific users or connections. An attacker who obtains a victim's session ID can send POST requests to the `/messages/:session_id` endpoint to trigger tool executions. The server processes these requests and sends the resulting tool output to the victim's Server-Sent Events (SSE) stream, effectively hijacking the session's integrity. This issue is addressed in version 0.23.0 by implementing session ownership checks.

Affected products

• Model Context Protocol (MCP) Ruby SDK mcp <= 0.22.0

Timeline

• 2026-07-08: disclosed: Initial report/publication on GitHub
• 2026-07-29: other: NVD publication
• 2026-07-30: patched: Version 0.23.0 released and advisory updated

References

• https://api.github.com/users/srikanthramu
• https://github.com/srikanthramu
• https://api.github.com/users/srikanthramu/gists%7B/gist_id%7D
• https://api.github.com/users/srikanthramu/repos
• https://avatars.githubusercontent.com/u/8922182?v=4
• https://api.github.com/users/srikanthramu/events%7B/privacy%7D