Executive Intelligence Brief

A critical vulnerability has been discovered in the MCP Python SDK, affecting servers that enable the experimental tasks feature. This feature, when activated, allows any connected client to access and manipulate tasks created by other clients. The vulnerability, tracked as CVE-2026-52870, has a CVSS v3 score of 7.6, indicating high severity. Affected versions range from 1.23.0 to 1.27.1. Immediate mitigation involves upgrading to version 1.27.2 or later, disabling the experimental tasks feature, or implementing custom task handlers with session validation.

Threat Overview

The MCP Python SDK is a library used for building applications that interact with the Model Context Protocol (MCP). The experimental tasks feature, enabled by server.experimental.enable_tasks(), allows clients to create and manage tasks. However, the default request handlers installed by this feature do not properly validate the session that created a task, leading to a lack of authorization controls.

This vulnerability matters because it can be exploited by any client connected to a server with multiple clients, allowing them to:

  • Enumerate all tasks
  • Read status and results of any task
  • Retrieve queued task messages intended for other clients
  • Cancel any task

The feature is opt-in and experimental, meaning servers that do not enable it are not affected. Additionally, servers that have registered their own task handlers instead of using the defaults are only affected if those handlers have the same vulnerability.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-862: Missing Authorization. This class of vulnerability occurs when an application does not properly verify the identity of a user or system before performing an action, leading to unauthorized access or manipulation of sensitive data.

The CVSS v3 vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, with a score of 7.6. This indicates:

  • Network attack vector (AV:N)
  • Low attack complexity (AC:L)
  • Low privileges required (PR:L)
  • No user interaction needed (UI:N)
  • Unchanged scope (S:U)
  • High confidentiality impact (C:H)
  • Low integrity impact (I:L)
  • Low availability impact (A:L)

Root Cause Analysis

The root cause of this vulnerability is the lack of session validation in the default task handlers. When tasks support is enabled, the handlers for tasks/list, tasks/get, tasks/result, and tasks/cancel operate solely on the task identifier without checking which session created the task. This oversight allows any client to access and manipulate tasks created by other clients.

Attack Vector & Chain

The attack vector involves a client exploiting the vulnerable task handlers to access or manipulate tasks without proper authorization. The attack chain includes:

  1. Initial access: The attacker is already connected to the server as a client.
  2. Exploitation: The attacker uses the vulnerable task handlers to enumerate, read, or cancel tasks belonging to other clients.

Exploitation Scenario Walkthrough

Scenario: Unauthorized Task Access and Manipulation

  1. Reconnaissance: An attacker discovers that the target server has the experimental tasks feature enabled by identifying the server.experimental.enable_tasks() call in the server's codebase or through other means.
  2. Weaponization: The attacker prepares by understanding the task handlers' behavior and how to exploit the lack of session validation.
  3. Delivery & Exploitation: The attacker, already connected as a client, sends requests to the vulnerable task handlers (e.g., tasks/list, tasks/get, tasks/cancel) to access or manipulate tasks created by other clients.
  4. Post-Exploitation: The attacker may use the accessed tasks to gather sensitive information, consume messages meant for other clients, or disrupt the tasks of other clients.
  5. Impact Realization: The final impact includes unauthorized access to task results, elicitation payloads, and the ability to cancel tasks, leading to potential data exposure and service disruption.

Exploitation in the Wild

The vulnerability is not currently known to be actively exploited. However, given its high severity and the potential for exploitation, it is essential to apply mitigations promptly.

Impact Analysis

Direct Impact

The direct impact of this vulnerability includes:

  • Unauthorized access to task results and elicitation payloads
  • Ability to cancel tasks created by other clients
  • Potential data exposure and service disruption

Downstream & Cascading Effects

Downstream effects may include:

  • Supply chain risk if the MCP Python SDK is used in critical infrastructure or sensitive applications
  • Regulatory implications due to data exposure
  • Operational disruption due to task cancellation or manipulation

Affected Products & Versions

Affected versions of the MCP Python SDK range from 1.23.0 to 1.27.1. The vulnerability is fixed in version 1.27.2.

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise may include:

  • Unusual task enumeration or access patterns
  • Task cancellations from unexpected clients
  • Anomalies in task results or elicitation payloads

Detection Rules & Signatures

Detection logic may involve monitoring:

  • Task handler logs for unusual access patterns
  • Network traffic for suspicious task-related requests

Threat Hunting Queries

Threat hunting queries may include searching for:

  • Task handler logs for evidence of exploitation
  • Unusual client behavior in task interactions

Remediation & Hardening

Immediate Actions (0-24 hours)

Immediate actions include:

  • Upgrading to version 1.27.2 or later
  • Disabling the experimental tasks feature if not in use
  • Implementing custom task handlers with session validation

Short-Term Hardening (1-7 days)

Short-term hardening measures include:

  • Enhancing monitoring of task handler logs and network traffic
  • Implementing additional security controls around task interactions

Strategic Recommendations

Strategic recommendations include:

  • Regularly reviewing and updating dependencies to ensure the latest security patches
  • Implementing robust access controls and session validation for sensitive features

Analyst Assessment

The vulnerability has a high severity due to its potential impact on confidentiality, integrity, and availability. While not actively exploited currently, the ease of exploitation and potential for significant impact make it critical to apply mitigations promptly. Organizations should prioritize upgrading to the fixed version or implementing alternative mitigations.

Sources