CVE-2026-52869 mcp python sdk vulnerability
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session, allowing a different bearer-token-authenticated client with a known session ID to inject JSON-RPC messages into that session. This issue is fixed in version 1.27.2.
Browse Python security risksQuick answer
lfprojects mcp python sdk should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- < 1.27.2
Fixed versions
- 1.27.2
How to fix it
MCP Python SDK (PyPI mcp) is affected by CVE-2026-52869, a missing principal binding check for authenticated HTTP sessions. A different authenticated client that learns a session ID can inject JSON-RPC messages into that session. Upgrade mcp to 1.27.2 or later and make sure the authentication layer supplies a stable principal, including AccessToken.subject when a shared OAuth client is used. Prioritize internet-facing and shared production systems first.
- Inventory every MCP Python SDK (PyPI mcp) deployment, version, exposed endpoint, environment, and owner.
- Check authenticated SSE and stateful Streamable HTTP deployments; stdio and stateless Streamable HTTP are not affected by this isolation flaw.
- Upgrade mcp to 1.27.2 or later and make sure the authentication layer supplies a stable principal, including AccessToken.subject when a shared OAuth client is used.
- If patching must wait, disable affected stateful transports or place each trusted principal behind a separate isolated service.
- Review session IDs, bearer-token principals, injected JSON-RPC messages, and output delivered to a token that did not create the session.
- Close exposed sessions and rotate bearer tokens or downstream credentials if a session may have been hijacked.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm mcp is 1.27.2 or later and every authenticated stateful transport binds its session to a stable token principal, including AccessToken.subject for shared OAuth clients.
- Confirm the owning principal can reuse its session while a different principal using the same session ID receives the same 404 as an unknown session.
- Confirm only intended clients and authenticated principals can reach the affected MCP transport, task, or session feature.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-52869.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-52869?
lfprojects mcp python sdk versions listed as affected should be reviewed: < 1.27.2.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.