The MCP Python SDK, known as mcp on PyPI, implements the Model Context Protocol. Between versions 1.23.0 and 1.27.2 the default handlers installed by server.experimental.enable_tasks()—specifically tasks/list, tasks/get, tasks/result, and tasks/cancel—operate only on task identifiers and do not record, and therefore do not verify, the session that created each task. As a result, any connected client can enumerate, read results from, consume messages for, or cancel tasks belonging to other clients. This missing access‑control flaw (CWE-862) enables an attacker to access or interfere with tasks they should not be authorized to manipulate. The issue is resolved in version 1.27.2.

Vendors and products affected include the ModelContextProtocol Python SDK, specifically versions 1.23.0 up to and including 1.27.2. The issue is resolved in the 1.27.2 release; users of earlier releases are vulnerable.

The CVSS score of 7.6 indicates a high severity risk, though the EPSS score of less than 1% suggests a very low current exploitation probability. Based on the description, it is inferred that the attack vector is primarily internal: any client authorized to connect to the MCP server can exploit the flaw. The vulnerability is not listed in the CISA KEV catalog, so widespread compromise has not yet been observed, but the potential for unauthorized task interference remains significant for environments with multiple clients.