Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-28 | 1 | Patch1 |
| 2026-03-30 | 1 | Disclosure1 |
| 2026-04-28 | 1 | Patch1 |
一気にやってくれたこと： → RuboCop 違反 63 → 0 → ついでに mcp gem の CVE-2026-33946 を patch（bundler-audit の警告を見て持ってきた） → postgres:17 の service container を追加 頼んだのは 1 つ。返ってきたのは 4 つ。
Post summary
The post indicates that the mcp gem CVE-2026-33946 was patched, but provides no further details on the vulnerability, exploit, or broader context.
RubySec ➜ CVE-2026-33946 (mcp): MCP Ruby SDK - Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay https://rubysec.com/advisories/CVE-2026-33946/
Post summary
RubySec has disclosed CVE-2026-33946, highlighting that insufficient session binding in the MCP Ruby SDK can lead to SSE stream hijacking through session ID replay.
CVE-2026-33946 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementati… https://www.cve.org/CVERecord?id=CVE-2026-33946
Post summary
The Ruby SDK before v0.9.2 is vulnerable per CVE-2026-33946; upgrading to v0.9.2 resolves the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | mcp_ruby_sdk | - | - | - |