MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
- Product
- MCP Python SDK
- CVE
- CVE-2026-52869
- Affected
- mcp <= 1.27.1
- Fixed in
- 1.27.2
Last verified against sources: October 26, 2026
Am I affected?
MCP Python SDK: affected mcp <= 1.27.1. Fixed in 1.27.2.
- Check your version: run
pip show mcp. Versions <= 1.27.1 of mcp are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "mcp>=1.27.2"(first patched version 1.27.2). [1] - Upgrade to version 1.27.2 or later. [1]
- Ensure your token verifier populates AccessToken.subject (e.g. from the token's sub claim) so sessions are isolated per user rather than per client. [1]
- Enforce an equivalent check yourself if using a custom authentication backend other than the built-in BearerAuthBackend. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. [1]
- Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried. [1]
- The SSE transport has been affected since the first release; the Streamable HTTP transport since version 1.8.0. [1]
Impact
- The per-client isolation that authentication provides can be bypassed for any session whose ID is known. [1]
- A request authenticated as a different OAuth client could inject messages into the session. [1]
- On the Streamable HTTP transport it is returned on the injecting request, so the injecting client can also read the result. [1]
- Exploitation requires obtaining a session ID out of band (logs, network observation). [1]
What was done
Sources
- GHSA-jpw9-pfvf-9f58 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-52869] MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Product: MCP Python SDK | Affected: mcp <= 1.27.1 | Fixed in: 1.27.2
Summary: In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-52869-mcp-python-sdkCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-52869
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.