CVE-2026-52870 mcp python sdk vulnerability
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.
Browse Python security risksQuick answer
lfprojects mcp python sdk should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- >= 1.23.0, < 1.27.2
Fixed versions
- 1.27.2
How to fix it
MCP Python SDK (PyPI mcp) is affected by CVE-2026-52870, a missing session ownership check in experimental task handlers. One connected client can list, read, consume, or cancel tasks created by another client. Upgrade mcp to 1.27.2 or later for the default task handlers; client-chosen task IDs, direct TaskStore writes, and custom handlers still require explicit session-ownership checks in application code. Prioritize internet-facing and shared production systems first.
- Inventory every MCP Python SDK (PyPI mcp) deployment, version, exposed endpoint, environment, and owner.
- Check for server.experimental.enable_tasks() and any custom task handlers or TaskStore paths; servers without experimental tasks are not affected.
- Upgrade mcp to 1.27.2 or later for the default task handlers; client-chosen task IDs, direct TaskStore writes, and custom handlers still require explicit session-ownership checks in application code.
- If patching must wait, disable experimental tasks or use custom handlers that validate the current session owns every task.
- Review task access, result reads, message consumption, and cancellations from sessions that did not create the task.
- Invalidate exposed task results, stop unauthorized jobs, and rotate secrets if task output contained credentials or private data.
- Restart or redeploy affected services when required, remove temporary artifacts, and keep compensating controls until validation is complete.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm mcp is 1.27.2 or later, then separately confirm application-level ownership checks cover client-chosen task IDs, direct TaskStore writes, and every custom task handler.
- Use two test sessions and confirm session B cannot list, get, consume messages from, read the result of, or cancel session A's task through the default handlers, custom handlers, client-chosen IDs, or direct TaskStore paths.
- Confirm only intended clients and authenticated principals can reach the affected MCP transport, task, or session feature.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-52870.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-52870?
lfprojects mcp python sdk versions listed as affected should be reviewed: >= 1.23.0, < 1.27.2.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.