Description
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.
Published: 2026-07-09
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

DeepSeek MCP Server versions from 1.4.2 up to before 1.7.0 expose session identifiers without associating them with an authenticated user or transport session (CWE-639). This allows an attacker to hijack an active conversation and continue it under the victim's context, enabling unauthorized access to private chat content.

Affected Systems

The vulnerable product is arikusi deepseek-mcp-server, specifically deployments running any released version between 1.4.2 and 1.6.x; version 1.7.0 and later contain the fix.

Risk and Exploitability

The vulnerability receives a CVSS score of 8.6, indicating high severity; the EPSS score of < 1% indicates low probability of exploitation, and it is not KEV cataloged. An attacker could enumerate active session IDs via deepseek_sessions and then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context, thereby achieving a full authorization bypass.

Generated by OpenCVE AI on July 29, 2026 at 11:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the deepseek-mcp-server package to version 1.7.0 or later, which removes the SessionStore flaw.
  • Restrict access to endpoint and ensure it is protected by authentication before enabling it.
  • Implement monitoring for anomalous session_id usage or repeated accesses to detect potential hijacking attempts.

Generated by OpenCVE AI on July 29, 2026 at 11:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Arikusi
Arikusi deepseek-mcp-server
Vendors & Products Arikusi
Arikusi deepseek-mcp-server

Thu, 09 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.
Title @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Arikusi Deepseek-mcp-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-10T14:42:09.579Z

Reserved: 2026-06-16T23:31:22.445Z

Link: CVE-2026-55604

cve-icon Vulnrichment

Updated: 2026-07-10T14:39:10.996Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:00:12Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key