Threats tagged 'brew-mistral-vibe-cve-2026-52870'

The MCP Python SDK's experimental task handlers feature, when enabled via server.experimental.enable_tasks(), does not verify task ownership by client session. This allows any connected client to list, read results from, and cancel tasks created by other clients on the same server. The issue affects versions from 1.1.1 up to but not including 2.17.0. The vulnerability is fixed in version 2.17.0 by embedding a per-session marker in task IDs and restricting handlers to operate only on tasks belonging to the requesting session.