High severity · published Jul 15, 2026
CVE-2026-52870
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
7.6
CVSS
0.4%
EPSS
No
On KEV
Description
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results from, consume messages for, or cancel other clients' tasks. This issue is fixed in version 1.27.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
python-sdk · modelcontextprotocol
>= 1.23.0, < 1.27.2 · source: vendor
MP
Mcp Python Sdk · Lfprojects
1.23.0 before 1.27.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52870
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52870
Patch
https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7
Issue Tracking
https://github.com/modelcontextprotocol/python-sdk/pull/2720
Release Notes
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2
Vendor Advisory
https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-hvrp-rf83-w775
More from python-sdk
8.7
CVE-2025-53366
MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
8.7
CVE-2025-53365
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service
8.1
CVE-2026-59950
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
8.1
CVE-2025-66416
DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost
7.5
CVE-2026-109527
Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies