CVE-2026-33946: 
Model Context Protocol vulnerability analysis and mitigation

CVE-2026-33946 is a session hijacking vulnerability in the MCP (Model Context Protocol) Ruby SDK's streamable_http_transport.rb implementation. An attacker who obtains a valid session ID can silently replace a legitimate user's Server-Sent Events (SSE) stream and intercept all real-time tool responses and notifications intended for that user. The vulnerability affects MCP Ruby SDK versions up to and including 0.9.1 (the mcp RubyGems package), and was disclosed on March 27, 2026. It carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory).

The root cause is classified under CWE-384 (Session Fixation) and CWE-639 (Authorization Bypass Through User-Controlled Key). The StreamableHTTPTransport in streamable_http_transport.rb stores only one SSE stream object per session ID and lacks session-to-user identity binding, ownership validation when establishing SSE connections, and protection against multiple simultaneous connections to the same session. Specifically, the store_stream_for_session method unconditionally overwrites the existing stream object when a new GET request arrives with the same Mcp-Session-Id header, silently disconnecting the legitimate client without any indication. By contrast, the Python SDK already prevented this by returning HTTP 409 Conflict on duplicate SSE connection attempts; the Go and C# SDKs implement user binding. The advisory includes concrete PoC scripts (legitimate_client_ruby_server.py and attacker_client_ruby_server.py) demonstrating the attack against a live Ruby SDK server (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to completely hijack a victim's SSE stream, redirecting all subsequent server-to-client messages — including tool responses and real-time notifications — to the attacker. The legitimate user is silently disconnected with no indication of the hijacking, while the attacker receives all confidential data flowing through the session. The impact is limited to confidentiality (no integrity or availability impact), but tool responses in MCP deployments may contain highly sensitive data depending on the tools configured (GitHub Advisory).

A public proof-of-concept exploit is available on GitHub, consisting of two Python scripts that reproduce the stream hijacking attack against a running Ruby SDK server (GitHub Advisory). Exploitation requires prior knowledge of a valid session ID (a SecureRandom.uuid), which limits practical severity in typical local MCP deployments but is more significant in multi-user or network-exposed environments. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.048% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify a network-accessible MCP Ruby SDK server (version ≤ 0.9.1) running with the streamable HTTP transport.
2. Legitimate session establishment: Observe or intercept a legitimate client's session ID. The session ID is transmitted in the Mcp-Session-Id HTTP header during the initial POST / (initialize) request and subsequent GET requests.
3. Session ID acquisition: Obtain the victim's session ID through network interception, log exposure, or other out-of-band means (the session ID is a UUID generated by SecureRandom.uuid).
4. Stream hijacking: Send a GET request to the MCP server endpoint with the header Mcp-Session-Id: <victim_session_id> and Accept: text/event-stream. The server's store_stream_for_session method overwrites the victim's stream with the attacker's stream.
5. Data interception: All subsequent server-to-client messages (tool responses, notifications) are now delivered to the attacker's SSE stream. The legitimate client is silently disconnected and receives no further data (GitHub Advisory, Patch Commit).

• Network: Unexpected GET requests to the MCP server endpoint containing a Mcp-Session-Id header that matches an already-active session; multiple simultaneous SSE connections from different source IPs using the same session ID.
• Logs: Server access logs showing a second GET request for an existing session ID from a different client IP or user agent; legitimate clients logging unexpected disconnections or loss of SSE stream without explicit termination.
• Application Behavior: Legitimate MCP clients reporting that they stopped receiving tool responses or notifications mid-session without any error; tool response data appearing to be delivered to an unexpected endpoint.

Upgrade the MCP Ruby SDK (mcp gem) to version 0.9.2 or later, which rejects duplicate SSE connections with HTTP 409 Conflict and adds a TOCTOU guard in store_stream_for_session to prevent stream overwriting (Patch Commit, GitHub Advisory). As a workaround prior to patching, restrict network access to MCP server endpoints to trusted clients only, and implement session ID binding to authenticated user identities at the application layer. Review active sessions for signs of unauthorized access and consider re-authenticating sessions in production environments running affected versions.

The vulnerability was originally reported via HackerOne (report #3556146) by researcher srikanthramu, who later re-reported it through the GitHub security advisory tab after the H1 report was closed. The advisory notes that of the 10 official MCP SDKs, only the C# and Go SDKs implemented session-to-user binding at the time of disclosure, highlighting a broader gap in MCP SDK security guidance. The patch commit message explicitly notes that practical severity is low in typical local MCP deployments due to the requirement to know a UUID session ID, but recommends the fix as defense-in-depth for multi-user or network-exposed deployments (GitHub Advisory, Patch Commit).