What’s Vulnerable › Vulnerabilities

CVE-2026-52870: MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-15 · updated 2026-10-24
• Weakness: CWE-862

Description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.

Affected products

• modelcontextprotocol python-sdk: from 1.23.0 before 1.27.2 — fixed in 1.27.2

How to fix

Upgrade to a fixed version: modelcontextprotocol python-sdk 1.27.2. Check the vendor advisory for mitigations.

References

• https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7
• https://github.com/modelcontextprotocol/python-sdk/pull/2720
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775

Get alerted when CVE-2026-52870 or the next vulnerability affects your stack