MCP SDK Session Hijacking via Missing Principal Verification in SSE/Streamable HTTP Transport
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 7.1
The MCP Python SDK's SSE and stateful Streamable HTTP transports route messages to sessions based solely on a session ID, without checking that the requesting client is the same authenticated principal who created that session. Any bearer-token-authenticated client that learns or guesses a valid session ID can inject JSON-RPC messages into another user's active session, effectively hijacking it. This is a serious cross-tenant authorization flaw fixed in version 1.27.2.
Technical Analysis
The vulnerability lies in mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager, which resolve incoming requests to server-side session state using only the session_id query parameter or Mcp-Session-Id header. Because no binding is enforced between the session and the identity that originally authenticated it, a second client holding valid bearer credentials for the MCP server (but not the original session owner) can supply a known or leaked session ID and have its JSON-RPC messages routed into the victim's session context. This allows an attacker to inject tool calls, manipulate conversation/tool state, or exfiltrate responses intended for another user, crossing a trust boundary between distinct authenticated clients sharing one MCP server instance. Exploitation requires only network access to the MCP endpoint, valid (even low-privilege) bearer credentials, and knowledge of an active session ID, which may be obtainable via logs, URLs, referrer leakage, or brute-forcing weak IDs.
Affected Systems
mcp (MCP Python SDK); protocols: MCP
Detection Signatures
- Multiple distinct bearer tokens/principals used against the same Mcp-Session-Id or session_id value within a short time window
- JSON-RPC requests referencing a session_id not previously issued to the requesting authenticated principal
- Unexpected tool invocations or state changes appearing in a session inconsistent with the session owner's activity
- Server logs showing session_id reuse across differing Authorization header values
- Spikes in session_id enumeration or guessing attempts (sequential or low-entropy IDs)
Remediation Steps
- 1
Upgrade the MCP SDK
Update mcp (PyPI) to version 1.27.2 or later, which binds sessions to the authenticated principal that created them.
- 2
Enforce principal-session binding
If running a custom or forked transport, verify that the authenticated identity on each request matches the identity that established the session before routing JSON-RPC messages.
- 3
Use high-entropy, unpredictable session identifiers
Ensure session IDs are cryptographically random and sufficiently long to prevent guessing or brute-force enumeration.
- 4
Avoid session ID leakage
Do not log full session IDs, pass them only via secure headers rather than URLs/query parameters, and ensure TLS is enforced end-to-end.
- 5
Add monitoring for session anomalies
Alert on session_id usage from multiple distinct authenticated principals or from unexpected IP/token combinations.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.