CVE-2026-33946

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33946

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33946.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33946

Aliases

GHSA-qvqr-5cv7-wh35

Published

2026-03-27T21:20:07.900Z

Modified

2026-04-02T13:29:10.610602Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

Details

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamablehttptransport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

Database specific

{
    "cwe_ids": [
        "CWE-384",
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33946.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/modelcontextprotocol/ruby-sdk

Affected ranges

Type

GIT

Repo

https://github.com/modelcontextprotocol/ruby-sdk

Events

Introduced

Fixed

3fc7bcd2683d2200d42f79ab46752dc65f896db1

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.9.2"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.7.1

v0.8.0

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33946.json"