CVE-2026-33946

Katalog CVE

CVSS 5.9 · Medium EPSS 0,54%

Kerentanan Session Fixation pada lfprojects mcp ruby sdk. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

Rincian

Terbit di NVD

27 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-384: Session Fixation
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,54% peluang dieksploitasi; lebih tinggi dari 43,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35 exploit · advisory vendor
• https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs... patch
• https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2 patch
• https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685 patch
• https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb patch
• https://github.com/modelcontextprotocol/ruby-sdk/commit/db40143402d65b4fb6923cec42d2d72cb89b3874 patch
• https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.9.2 product · release notes
• https://hackerone.com/reports/3556146 permissions required