MCP Python SDK Task Isolation Broken Access Control (Cross-Session Task Hijack)
First seen Jul 16, 2026 · Updated Jul 16, 2026 · CVSS 7.6
The MCP Python SDK's experimental task management feature failed to bind tasks to the session that created them, allowing any connected client to list, read, cancel, or consume messages for tasks belonging to other clients. This is a broken access control / IDOR-style flaw that breaks the trust boundary between concurrent MCP sessions on the same server. It is fixed in version 1.27.2.
Technical Analysis
The vulnerability lies in default handlers for tasks/list, tasks/get, tasks/result, and tasks/cancel installed by server.experimental.enable_tasks(), which index and authorize operations purely by task identifier rather than validating that the requesting session matches the task's owning session. An attacker with any active MCP client connection to the same server can enumerate task IDs (or guess/observe them) and issue tasks/get, tasks/result, tasks/cancel, or tasks/list calls to read results, consume streamed messages, or cancel tasks belonging to a different client's session. This crosses the multi-tenant isolation boundary that MCP servers are expected to enforce between distinct client sessions, potentially exposing sensitive tool outputs or disrupting other agents'/users' in-flight operations on a shared server instance. The impact is amplified in deployments where MCP servers are shared across multiple users, tenants, or agent instances relying on the experimental async task API.
Affected Systems
mcp (Python SDK, PyPI package 'mcp'); protocols: MCP
Detection Signatures
- Unusual tasks/get, tasks/result, or tasks/cancel calls referencing task IDs not issued to the requesting session
- High-frequency tasks/list enumeration from a single client shortly after connecting
- Cross-session task ID reuse or access patterns in server logs
- Unexpected task cancellations correlated with a different client session than the task originator
- Presence of mcp package version 1.23.0-1.27.1 with enable_tasks() invoked in server configuration
Remediation Steps
- 1
Upgrade mcp SDK
Update the 'mcp' PyPI package to version 1.27.2 or later, which binds tasks to their originating session.
- 2
Audit experimental task usage
Review any servers using server.experimental.enable_tasks() prior to patching and check logs for cross-session task access.
- 3
Enforce session-scoped authorization
If running custom task handlers or forks, explicitly validate that the requesting session matches the task-owning session before honoring tasks/get, tasks/result, tasks/cancel, or tasks/list requests.
- 4
Isolate multi-tenant deployments
Where possible, run separate MCP server processes per tenant/user rather than relying solely on in-process session isolation for sensitive workloads.
- 5
Monitor task ID exposure
Avoid predictable/sequential task IDs and monitor for enumeration attempts against the tasks/list endpoint.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.