CVE-2026-52870

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52870
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52870.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52870
Aliases
Downstream
Related
Published
2026-07-15T20:07:53.500Z
Modified
2026-08-12T03:51:36.075261841Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
Summary
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Details

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52870.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/modelcontextprotocol/python-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/python-sdk
Events
Introduced
d3a184119e4479ea6a63590bc41f01dc06e3fa99
Fixed
62137874ff26dd74d2fea80ff528a7fd9ca7a5e7
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:lfprojects:mcp_python_sdk:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.23.0"
        },
        {
            "fixed": "1.27.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.23.0
v1.23.1
v1.23.2
v1.23.3
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52870.json"