CVE-2026-33946CWE-384CWE-639

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

High · published March 27, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00541 · 44.7th percentile
Weaknesses
CWE-384 · Session Fixation; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-03-27T21:20Z
EPSS history
Timeline
  • 27 MAR 21:20Z
    MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
    cvelistv5