CVE-2026-67431: MCP Ruby SDK: Ruby SSE Session Poisoning
Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK’s Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim’s session. This is a silent attack - the victim’s session is compromised and being used for unauthorized actions, but it is hard to know for the victim
References
- github.com/advisories/GHSA-5p9g-j988-pcwv
- github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356
- github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
- github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv
- nvd.nist.gov/vuln/detail/CVE-2026-67431
Code Behaviors & Features
Detect and mitigate CVE-2026-67431 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →