Metatool‑ai MetaMCP up to version 2.4.22 implements an insecure direct object reference. The session store identifies sessions solely by the client‑supplied mcp-session-id header, without binding the session to the tenant, namespace, or request endpoint. This design allows an attacker to obtain another tenant’s active session ID from the publicly exposed /metamcp/health/sessions endpoint, which reveals session IDs and namespace UUIDs. Armed with that session ID, the attacker can list and invoke the victim tenant’s private MCP tools and exfiltrate data using the victim’s forwarded credentials. The result is a loss of confidentiality and integrity for the victim tenant’s data.

The affected product is Metatool‑ai MetaMCP version 2.4.22 and all earlier releases. Any deployment that has not been upgraded beyond this version remains susceptible to the IDOR flaw.

The CVSS score of 9.1 indicates critical severity, and the EPSS score of <1% suggests a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication for the health endpoint and the ease of reusing a valid session ID make the flaw highly exploitable in environments where MetaMCP is reachable from untrusted networks. Attackers can perform the exploitation with simple HTTP requests and no special credentials, leading to immediate potential data compromise for affected tenants.