CVE-2026-52870: MCP Python SDK Information Disclosure Flaw

CVE-2026-52870 Overview

CVE-2026-52870 is a missing authorization vulnerability [CWE-862] in the Model Context Protocol (MCP) Python SDK, distributed as the mcp package on PyPI. Affected versions from 1.23.0 through 1.27.1 install default handlers via server.experimental.enable_tasks() that operate on task identifiers without verifying the originating session. Any connected client can enumerate, read, consume, or cancel tasks belonging to other clients through the tasks/list, tasks/get, tasks/result, and tasks/cancel operations. The maintainers fixed the issue in version 1.27.2 by scoping task IDs to the session that created them.

Critical Impact
A low-privileged network attacker with a valid MCP session can access, consume, or cancel tasks and results owned by other connected clients, breaking tenant isolation in multi-client MCP server deployments.

Affected Products

MCP Python SDK (mcp on PyPI) versions 1.23.0 through 1.27.1
MCP servers using server.experimental.enable_tasks() with default handlers
Downstream applications embedding the vulnerable SDK for multi-client task workflows

Discovery Timeline

2026-07-15 - CVE-2026-52870 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52870

Vulnerability Analysis

The MCP Python SDK exposes an experimental tasks subsystem enabled through server.experimental.enable_tasks(). When enabled, the SDK registers default handlers for four operations: tasks/list, tasks/get, tasks/result, and tasks/cancel. These handlers accept a task identifier and dispatch directly to task state without cross-referencing the session that submitted the original request.

Because task identifiers are globally scoped within the server process, any authenticated client can supply an identifier belonging to another session. The server processes the request and returns results, streams messages, or performs the cancel action without an ownership check. This allows cross-session data disclosure, message consumption, and disruption of in-flight work.

Root Cause

The root cause is missing authorization on task lookups. The default handlers treat task IDs as capabilities on their own, rather than validating that the caller's ServerSession matches the session that created the task. The patch introduces a task_scope module and a scoped_task_id helper that binds each task ID to its creating session, adding the missing authorization check.

Attack Vector

Exploitation requires network access and a valid session to an MCP server that has enabled the experimental tasks feature. The attacker enumerates or guesses task IDs, then issues tasks/get, tasks/result, or tasks/cancel requests referencing another client's task. No user interaction is required, and the attack complexity is low.

python

# Patch excerpt: src/mcp/server/experimental/request_context.py
# [v1.x] Scope experimental tasks to the session that created them (#2720)

+import warnings
 from collections.abc import Awaitable, Callable
 from dataclasses import dataclass, field
-from typing import Any
+from typing import Any, overload
+
+from typing_extensions import deprecated

 from mcp.server.experimental.task_context import ServerTaskContext
+from mcp.server.experimental.task_scope import scoped_task_id
 from mcp.server.experimental.task_support import TaskSupport
 from mcp.server.session import ServerSession
 from mcp.shared.exceptions import McpError

Source: GitHub Commit 62137874

Detection Methods for CVE-2026-52870

Indicators of Compromise

Task operation requests where the requesting session ID does not match the session that originally created the referenced task ID in server logs.
Repeated tasks/list, tasks/get, or tasks/result calls from a single client referencing task IDs across a broad numeric or UUID range, suggesting enumeration.
Unexpected tasks/cancel events terminating tasks that legitimate clients did not request to cancel.

Detection Strategies

Instrument MCP server handlers to log the tuple of (session_id, task_id, operation) for every task-related request, then alert on mismatches between the caller and the task owner.
Baseline normal task access patterns per client and flag clients that access task IDs they did not create.
Review dependency manifests (requirements.txt, pyproject.toml, poetry.lock) for mcp versions between 1.23.0 and 1.27.1.

Monitoring Recommendations

Forward MCP server application logs to a centralized analytics platform and retain task lifecycle events for correlation.
Monitor process telemetry on hosts running MCP servers for unexpected outbound streams of task result data.
Track PyPI package inventory across build pipelines and production hosts to identify systems still running vulnerable mcp releases.

How to Mitigate CVE-2026-52870

Immediate Actions Required

Upgrade the mcp PyPI package to version 1.27.2 or later on every host running an MCP server.
Audit MCP server code for calls to server.experimental.enable_tasks() and disable the feature until the upgrade is verified.
Rotate or invalidate long-lived client sessions after upgrading to reset any task state that may have been observed by unauthorized clients.

Patch Information

The fix ships in version 1.27.2 of the MCP Python SDK. The patch introduces a task_scope module and applies scoped_task_id inside the experimental request context so that task handlers validate the caller's ServerSession before returning results or executing cancellations. Refer to the GitHub Security Advisory GHSA-hvrp-rf83-w775, Pull Request #2720, and the v1.27.2 Release Notes.

Workarounds

Do not call server.experimental.enable_tasks() in production deployments until the SDK is upgraded to 1.27.2.
Restrict MCP server exposure to a single trusted client per process instance, eliminating cross-client task access opportunities.
Implement a custom authorization wrapper around the experimental task handlers that validates the calling session against the task owner before dispatch.

bash

# Upgrade the vulnerable package
pip install --upgrade "mcp>=1.27.2"

# Verify the installed version
pip show mcp | grep -i version

# Poetry-managed projects
poetry add "mcp@^1.27.2"