CVE-2026-52869: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

What it is

In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried.

Am I affected? Only if a developer's application server uses an HTTP transport (SSE, or Streamable HTTP in stateful mode) and authenticates requests. Servers on stdio, stateless Streamable HTTP, or with no authentication configured are not affected.

Both transports look up the target session by its identifier alone — the session_id query parameter for SSE (mcp.server.sse.SseServerTransport) and the Mcp-Session-Id header for Streamable HTTP (mcp.server.streamable_http_manager.StreamableHTTPSessionManager). Once the lookup succeeded, the request was handled on that session without comparing its authentication context to the credentials presented when the session was created, so a request authenticated as a different OAuth client could inject messages into the session.

How to check

1. Affected: mcp (pip) <= 1.27.1.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade mcp to 1.27.2 or later.

pip show mcp | grep Version

Sources

• GitHub Security Advisory GHSA-jpw9-pfvf-9f58 ↗
• NVD: CVE-2026-52869 ↗