High severity · published Jul 15, 2026
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-sdk · modelcontextprotocol
>= 1.23.0, < 1.27.2 · source: vendor
MP
Mcp Python Sdk · Lfprojects
1.23.0 before 1.27.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52870
Patch
https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7
Issue Tracking
https://github.com/modelcontextprotocol/python-sdk/pull/2720
Release Notes
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2
Vendor Advisory
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775
More from python-sdk
8.1
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies
7.1
CVE-2026-52869
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
6.9
CVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
6.8
CVE-2026-116684
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server