CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

What it is

In affected versions, the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and cancel tasks belonging to other clients.

Am I affected? Only if the developer's application server calls server.experimental.enable_tasks(). If grep -r enable_tasks over their codebase finds nothing, the application is not affected.

When tasks support is enabled on the low-level server, default handlers are registered for tasks/list, tasks/get, tasks/result, and tasks/cancel. These handlers operated on the task identifier alone and kept no record of the session that created each task.

How to check

1. Affected: mcp (pip) >= 1.23.0, <= 1.27.1.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade mcp to 1.27.2 or later.

pip show mcp | grep Version

Sources

• GitHub Security Advisory GHSA-hvrp-rf83-w775 ↗
• NVD: CVE-2026-52870 ↗