GHSA-5p9g-j988-pcwv CVE-2026-67431

MCP Ruby SDK: Ruby SSE Session Poisoning

High RubyGems

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.36%; Chance of exploitation in the next 30 days. Higher than 30.19% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-284 Improper Access Control
Fix: 0.23.0; Upgrade mcp to this version or later

Description

Summary

Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim

Details

https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L260-L278

Victim starts a legitimate MCP session and receives session ID abc-123 Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis) Attacker sends POST to /messages/abc-123 with a tool call Server accepts the request (no ownership validation!) Server executes the tool and sends response to victim's SSE stream Victim receives attacker's response, thinking it's legitimate

PoC

attacker_client.py legitimate_client.py

Prerequisites

Python 3.8+
Install dependencies: requests

Running the Demo

Terminal 1: Start the Ruby MCP Server

ruby streamable_http_server.rb

Makes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb This server has a tool call notification_tool which the clients call

Terminal 2: Start Victim Client

python3 legitimate_client.py

Terminal 3 - Attacker Client:

Copy the session ID from Terminal 1 and run:

python3 attacker_client.py abc-123-def-456

Back to Terminal 2 - Victim sees the injected response:

Impact

Integrity: HIGH - Attacker can execute unauthorized tools and modify state
Availability: LOW - Attacker can disrupt victim's session with injected responses

Additional Details

Session Hijacking Protection in MCP Implementations

The MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".

User Binding - Comparison other SDKs

csharp-sdk

Go-sdk

Comparison with the Stream Replacement vulnerability

Stream Replacement https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35

Target: SSE stream connection
Attack Vector: GET /mcp
What happens to Victim: The connection is disconnected and doesn't receive reponses

Session Poisoning

Target: Tool execution
Attack Vector: POST /mcp
What happens to Victim: The connection stays connected and receives responses of tool calls by attacker

Affected versions

RubyGems

Package	Vulnerable	Fixed in
mcp	`< 0.23.0`	`0.23.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

mcp RubyGems → `0.23.0`

bundler

bundle update mcp # Gemfile: gem "mcp", ">= 0.23.0"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): Low
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

Weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-67431

Packages

github.com/modelcontextprotocol/ruby-sdk

Timeline

Jul 29, 2026 Published
Oct 24, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-h669-8m4g-r2hc MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport	High	Also affects mcp
GHSA-52jp-gj8w-j6xh MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood	Medium	Also affects mcp
GHSA-7683-3w9x-ch42 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)	Medium	Also affects mcp
GHSA-rjr6-rcgv-9m7m MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection	Medium	Also affects mcp
GHSA-qvqr-5cv7-wh35 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay	Medium	Also affects mcp
GHSA-8g5g-mxqh-grgj Vite: `server.fs.deny` bypassed with queries	Medium	Same weakness, CWE-284
GHSA-rq7h-c2jc-7f22 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine	Medium	Same weakness, CWE-284
GHSA-pjr3-86v4-5p7w Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)	Medium	Same weakness, CWE-284

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor