Snyk agent scan: MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal (CVE-2026-52869)

The MCP Python SDK's SSE and Streamable HTTP server transports route incoming requests to existing sessions based only on the session identifier, without verifying that the request is authenticated as the same principal that created the session. This flaw allows an attacker who obtains a session ID to inject JSON-RPC messages into that session, bypassing per-client authentication isolation. The SSE transport has been affected since the first release, and the Streamable HTTP transport since version 1.8.0. The vulnerability requires the server to use bearer-token authentication and stateful HTTP transports. The patch in version 1.27.2 enforces verification of the authenticated principal against the session creator, returning a 404 response if they differ.

The vulnerability allows an attacker who obtains or guesses a valid session ID to bypass authentication isolation and send messages on behalf of the session owner. This compromises confidentiality and integrity of session data and operations. The impact is high due to the ability to impersonate authenticated clients within the session context. However, exploitation requires out-of-band access to session IDs, which are UUIDs. Servers not using bearer-token authentication or stateless Streamable HTTP transports are not affected.

Upgrade the MCP Python SDK to version 1.27.2 or later, which implements verification of the authenticated principal for each session and rejects requests with mismatched principals. For deployments where multiple end users share a single OAuth client, ensure the token verifier populates the AccessToken.subject to isolate sessions per user. Custom authentication backends should implement equivalent principal verification. No other immediate actions are required if the upgrade is applied.