DeepSeek MCP Server Session ID Hijacking (Broken Session Authorization)
First seen Jul 10, 2026 · Updated Jul 10, 2026 · CVSS 8.6
The DeepSeek MCP Server fails to bind session IDs to authenticated users or transport sessions, allowing any caller to enumerate active sessions and hijack another user's conversation context. This lets an attacker read and continue a victim's private chat history, exposing sensitive data and enabling impersonation within the session. The flaw is patched in version 1.7.0.
Technical Analysis
The MCP server's global SessionStore accepts arbitrary caller-supplied session_id values in the deepseek_chat tool without verifying that the caller owns or is authorized to access that session. The deepseek_sessions endpoint further aids attackers by allowing enumeration of active session IDs, effectively acting as an authorization oracle. Combined, this allows an attacker to guess or list valid session_id values and pass them into deepseek_chat to retrieve and append to a victim's conversation history, crossing trust boundaries between distinct MCP clients that should be isolated. This is a classic broken object-level authorization (IDOR-style) flaw applied to agent/session state rather than traditional REST resources, and it undermines the confidentiality and integrity guarantees MCP clients typically assume for per-session context.
Affected Systems
DeepSeek MCP Server; protocols: MCP
Detection Signatures
- Repeated or automated calls to deepseek_sessions from a single client in short intervals
- Use of deepseek_chat with session_id values not previously issued to the calling client/principal
- Session IDs reused across different source IPs, transports, or authentication contexts
- Anomalous continuation of conversation context with no matching prior request history for that client
Remediation Steps
- 1
Upgrade to version 1.7.0 or later
Apply the vendor patch that binds session_id values to authenticated principals/transport sessions.
- 2
Enforce session ownership checks
Ensure SessionStore validates that the requesting principal matches the session's original owner before allowing reads or continuations.
- 3
Restrict or authenticate session enumeration
Limit deepseek_sessions to return only sessions owned by the requesting principal, and require authentication for this endpoint.
- 4
Rotate and randomize session identifiers
Use cryptographically random, non-guessable session IDs and avoid exposing them in bulk listings.
- 5
Audit historical access logs
Review logs for cross-session access patterns indicating past exploitation prior to patching.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.