The MCP Python SDK, in versions earlier than 1.27.2, contains a flaw in its SSE and stateful Streamable HTTP transports that permits the server to route requests to an existing session based solely on the session_id query parameter or the Mcp-Session-Id header, without verifying the authenticated principal that created the session. Because of this mis‑authorization, an attacker who knows a valid session ID can inject arbitrary JSON‑RPC messages into that session, potentially enabling execution of any server‑exposed commands and leading to data tampering or unintended actions.

Affected systems are the Model Context Protocol Python SDK (PyPI package mcp) versions earlier than 1.27.2. The issue is present in the SSE and stateful Streamable HTTP transports before the 1.27.2 release. Users of any older SDK version that relies on these transports are at risk until they upgrade.

The vulnerability carries a CVSS score of 7.1, indicating moderate to high severity, and an EPSS <1%, suggesting that the likelihood of exploitation is currently low but not negligible. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to obtain the session identifier, which may be done through traffic sniffing or session ID reuse. Once an ID is known, a bearer‑token‑authenticated client can send malicious JSON‑RPC traffic to the server, and because the system fails to verify the authenticated principal, the injected commands are accepted without restriction.