CVE-2026-67431Disclosure

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that execute in the victim's session. This issue is fixed in version 0.23.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR91d
Disclosure
🚨High - MCP Ruby SDK Session Hijack via Unbound Session IDs (CVE-2026-67431) In MCP Ruby SDK MCP::Server::Transports::StreamableHTTPTransport, session IDs aren’t bound to a session owner. An attacker who obtains a victim’s session ID can send tools/call requests that execute in the victim’s session, leading to unauthorized tool execution. 👉Affected: mcp < 0.23.0 | Upgrade to 0.23.0
Post summary
The message announces a high‑severity session hijack vulnerability in MCP Ruby SDK, explains the technical details, and advises upgrading to version 0.23.0.
0000088
275 followersView on X

Explore more

Back to dashboard