CVE-2026-33946

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33946
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33946.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33946
Aliases
Published
2026-03-27T21:20:07.900Z
Modified
2026-07-15T01:48:52.435680321Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
Details

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamablehttptransport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33946.json",
    "cwe_ids": [
        "CWE-384",
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/modelcontextprotocol/ruby-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/ruby-sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3fc7bcd2683d2200d42f79ab46752dc65f896db1
Fixed
db40143402d65b4fb6923cec42d2d72cb89b3874
Database specific 
{
    "cpe": "cpe:2.3:a:lfprojects:mcp_ruby_sdk:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33946.json"