Skip to content
Threat Feed
Subscribe

Product

Mcp (>= 1.23.0, <= 1.27.1)

1 brief RSS
medium advisory

MCP Python SDK Vulnerability Allows Cross-Client Task Access and Cancellation (CVE-2026-52870)

A high-severity vulnerability (CVE-2026-52870) in the MCP Python SDK's experimental task handlers, specifically in versions 1.23.0 through 1.27.1, allows any connected client to observe, read results from, and cancel tasks belonging to other clients due to a lack of session validation, potentially leading to unauthorized data access and denial of service.

mcp vulnerability server-side-request-forgery data-exfiltration denial-of-service
3t 1c