The MCP Ruby SDK allows client applications to interact with Model Context Protocol servers. Prior to version 0.23.0 the StreamableHTTPTransport does not tie a session ID to its session owner. An attacker who obtains a valid session ID can forge tool or call requests that execute within the victim’s session context, enabling the attacker to run commands or manipulate resources as if they were the legitimate session holder. This flaw is effectively a remote code execution vector that bypasses normal authentication and authorization checks.

The affected product is the Model Context Protocol Ruby SDK. All releases before 0.23.0 are vulnerable. Users of version 0.22.x and earlier should verify that they do not use an older gem version.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker must obtain a stolen session ID, which may be achieved through network eavesdropping or compromising a client. Once in possession of such an ID, the attacker can inject malicious tool or call requests that run with the victim’s privileges.