{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/arikusi/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-55604"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["deepseek-mcp-server (1.4.2 to 1.6.9)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Arikusi"],"content_html":"\u003cp\u003eThe \u003ccode\u003edeepseek-mcp-server\u003c/code\u003e package, specifically when configured for HTTP transport, contains a critical authorization vulnerability (CVE-2026-55604) that leads to cross-session data exposure. The vulnerability stems from a process-global \u003ccode\u003eSessionStore\u003c/code\u003e implementation that fails to bind session identifiers to specific, authenticated transport sessions. Because the server treats user-supplied \u003ccode\u003esession_id\u003c/code\u003e strings as globally accessible keys, any client connected to the HTTP server can enumerate existing session IDs via the \u003ccode\u003edeepseek_sessions\u003c/code\u003e tool and subsequently interact with those sessions using the \u003ccode\u003edeepseek_chat\u003c/code\u003e tool.\u003c/p\u003e\n\u003cp\u003eThis flaw effectively bypasses tenant isolation, permitting an attacker to read the conversation history of other users, inject new messages into ongoing conversations, or clear existing sessions. This issue affects versions 1.4.2 through 1.6.9. It does not impact the STDIO transport mode, as each STDIO connection runs in an isolated process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker connects to the \u003ccode\u003edeepseek-mcp-server\u003c/code\u003e instance over the HTTP transport.\u003c/li\u003e\n\u003cli\u003eThe attacker calls the \u003ccode\u003edeepseek_sessions\u003c/code\u003e tool with an action parameter of 'list' to enumerate all currently active session IDs in the global store.\u003c/li\u003e\n\u003cli\u003eThe server responds with a list of active \u003ccode\u003esession_id\u003c/code\u003e values, including those belonging to other connected users.\u003c/li\u003e\n\u003cli\u003eThe attacker selects a target \u003ccode\u003esession_id\u003c/code\u003e from the enumerated list.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the \u003ccode\u003edeepseek_chat\u003c/code\u003e tool, providing the target \u003ccode\u003esession_id\u003c/code\u003e as an input parameter.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edeepseek_chat\u003c/code\u003e implementation in \u003ccode\u003esrc/tools/deepseek-chat.ts\u003c/code\u003e loads the victim's conversation history associated with the supplied ID.\u003c/li\u003e\n\u003cli\u003eThe attacker's new prompt is appended to the victim's existing conversation context and sent to the LLM backend.\u003c/li\u003e\n\u003cli\u003eThe final assistant response is stored back into the victim's session, effectively poisoning or hijacking the conversation flow.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for complete compromise of conversation privacy and integrity for all users connected to a multi-client HTTP instance of the server. Attackers can perform unauthorized data exfiltration of chat logs, influence the context of ongoing sessions, and perform denial-of-service by clearing session state. The number of impacted organizations is potentially high, given the use of MCP servers in collaborative AI development environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately upgrade \u003ccode\u003earikusi/deepseek-mcp-server\u003c/code\u003e to version 1.7.0 or later to ensure proper session store isolation.\u003c/li\u003e\n\u003cli\u003eFor environments where upgrading is not immediately feasible, disable the HTTP transport by unsetting the \u003ccode\u003eTRANSPORT\u003c/code\u003e environment variable to force the use of the unaffected STDIO transport.\u003c/li\u003e\n\u003cli\u003eAudit MCP server access logs to identify anomalous enumeration activity, specifically frequent requests to \u003ccode\u003edeepseek_sessions\u003c/code\u003e followed by rapid interactions with \u003ccode\u003edeepseek_chat\u003c/code\u003e using varying session identifiers.\u003c/li\u003e\n\u003cli\u003eImplement network-level access controls to restrict exposure of the HTTP-based MCP server instance to trusted clients only.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-25T18:48:41Z","date_published":"2026-08-25T18:48:41Z","id":"https://feed.craftedsignal.io/briefs/2026-08-deepseek-mcp-server-auth-bypass/","summary":"An insecure global SessionStore implementation in deepseek-mcp-server versions 1.4.2 through 1.6.9 allows unauthorized callers to enumerate and manipulate other users' conversation contexts via the HTTP transport.","title":"Cross-Session Data Exposure and Authorization Bypass in deepseek-mcp-server","url":"https://feed.craftedsignal.io/briefs/2026-08-deepseek-mcp-server-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Arikusi","version":"https://jsonfeed.org/version/1.1"}