Cross-Session Data Exposure and Authorization Bypass in deepseek-mcp-server

The deepseek-mcp-server package, specifically when configured for HTTP transport, contains a critical authorization vulnerability (CVE-2026-55604) that leads to cross-session data exposure. The vulnerability stems from a process-global SessionStore implementation that fails to bind session identifiers to specific, authenticated transport sessions. Because the server treats user-supplied session_id strings as globally accessible keys, any client connected to the HTTP server can enumerate existing session IDs via the deepseek_sessions tool and subsequently interact with those sessions using the deepseek_chat tool.

This flaw effectively bypasses tenant isolation, permitting an attacker to read the conversation history of other users, inject new messages into ongoing conversations, or clear existing sessions. This issue affects versions 1.4.2 through 1.6.9. It does not impact the STDIO transport mode, as each STDIO connection runs in an isolated process.

Attack Chain

1. The attacker connects to the deepseek-mcp-server instance over the HTTP transport.
2. The attacker calls the deepseek_sessions tool with an action parameter of 'list' to enumerate all currently active session IDs in the global store.
3. The server responds with a list of active session_id values, including those belonging to other connected users.
4. The attacker selects a target session_id from the enumerated list.
5. The attacker executes the deepseek_chat tool, providing the target session_id as an input parameter.
6. The deepseek_chat implementation in src/tools/deepseek-chat.ts loads the victim's conversation history associated with the supplied ID.
7. The attacker's new prompt is appended to the victim's existing conversation context and sent to the LLM backend.
8. The final assistant response is stored back into the victim's session, effectively poisoning or hijacking the conversation flow.

Impact

The vulnerability allows for complete compromise of conversation privacy and integrity for all users connected to a multi-client HTTP instance of the server. Attackers can perform unauthorized data exfiltration of chat logs, influence the context of ongoing sessions, and perform denial-of-service by clearing session state. The number of impacted organizations is potentially high, given the use of MCP servers in collaborative AI development environments.

Recommendation

1. Immediately upgrade arikusi/deepseek-mcp-server to version 1.7.0 or later to ensure proper session store isolation.
2. For environments where upgrading is not immediately feasible, disable the HTTP transport by unsetting the TRANSPORT environment variable to force the use of the unaffected STDIO transport.
3. Audit MCP server access logs to identify anomalous enumeration activity, specifically frequent requests to deepseek_sessions followed by rapid interactions with deepseek_chat using varying session identifiers.
4. Implement network-level access controls to restrict exposure of the HTTP-based MCP server instance to trusted clients only.