Snyk agent scan: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks (CVE-2026-52870)

In affected versions of the MCP Python SDK (>=0.4.3 <0.5.17), the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) do not check which client session created a task before allowing operations on it. This means that on servers with multiple connected clients, any client can enumerate all tasks, read their statuses and results, consume queued messages intended for other clients, and cancel tasks belonging to others. The vulnerability arises because the handlers operate solely on task identifiers without tracking session ownership. The issue is mitigated in version 1.27.2 and later by embedding an opaque per-session marker in task IDs and restricting handlers to only allow access to tasks belonging to the requesting session. Alternatively, disabling the experimental tasks feature or implementing custom handlers that validate session ownership also mitigates the risk.

Clients connected to a server running an affected version with the experimental tasks feature enabled can access and interfere with tasks created by other clients. This includes reading sensitive task results and elicitation payloads, consuming messages meant for other clients, and cancelling their tasks. This compromises confidentiality and availability of task data between clients sharing the same server instance. Servers not enabling the experimental feature or using custom handlers that enforce session validation are not affected.

A fix is available in version 1.27.2 or later, which adds session ownership validation by embedding a per-session marker in task IDs and restricting default handlers to only operate on tasks belonging to the requesting session. Servers should upgrade to this version to remediate the vulnerability. Alternatively, keep the experimental tasks feature disabled or implement custom task handlers that validate session ownership before acting on tasks. No other mitigation is required if the feature is not enabled.