{"vulnerability": "CVE-2026-67431", "sightings": [{"uuid": "feade581-b2be-4ef2-8950-fd2a58037a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-67431", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv", "content": "", "creation_timestamp": "2026-07-30T16:35:20.729425Z"}, {"uuid": "1e681153-7a81-4e69-b8e0-2b0870cfa1b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://gist.github.com/alon710/eb7bbb63a594430d7d6ab18e1b915ebd", "content": "# CVE-2026-67431: CVE-2026-67431: Session Poisoning via Improper Access Control in Model Context Protocol Ruby SDK\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67431\n\n## Summary\nAn Improper Access Control vulnerability exists in the Model Context Protocol (MCP) Ruby SDK prior to version 0.23.0. The stateful transport implementation failed to bind established sessions to their original owners or connection contexts, enabling unauthorized actors with access to active session IDs to execute arbitrary tools or alter session state.\n\n## TL;DR\nA lack of session binding in the MCP Ruby SDK allows remote attackers possessing a valid session ID to execute arbitrary tool calls and manipulate session states.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-284\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.3\n- **EPSS Score**: 0.00276\n- **Exploit Status**: POC (in official repository tests)\n- **KEV Status**: Not Listed\n- **Impact**: High Integrity, Low Availability\n\n## Affected Systems\n\n- mcp (RubyGems)\n- Model Context Protocol Ruby SDK\n- **mcp**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade the mcp gem to version 0.23.0 or higher.\n- Implement the session_request_validator hook to validate incoming requests against active user authentication states.\n- Limit session idle timeouts and maximum concurrent sessions to reduce exposure.\n\n**Remediation Steps:**\n1. Identify all deployments using the mcp Ruby gem.\n2. Update the Gemfile to require version 0.23.0 or higher: gem 'mcp', '>= 0.23.0'.\n3. Execute bundle update mcp to install the patched version.\n4. Locate instantiate configurations of MCP::Server::Transports::StreamableHTTPTransport and define a custom session_request_validator callback.\n5. Ensure the callback validates that the user environment (cookies, tokens) matches the active session ownership context.\n\n## References\n\n- [https://www.cve.org/CVERecord?id=CVE-2026-67431](https://www.cve.org/CVERecord?id=CVE-2026-67431)\n- [https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-5p9g-j988-pcwv)\n- [https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356](https://github.com/modelcontextprotocol/ruby-sdk/commit/35466605319a34e4c7808712ae9bb1ca1afb2356)\n- [https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0](https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0)\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-67431](https://nvd.nist.gov/vuln/detail/CVE-2026-67431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67431) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T02:31:09.791759Z"}, {"uuid": "706fbabc-bd15-4add-9819-b116f1bc6170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67431", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsu6t2mfx2q", "content": "CVE-2026-67431 - MCP Ruby SDK: Ruby SSE Session Poisoning\nCVE ID : CVE-2026-67431\n \n Published : July 29, 2026, 8:17 p.m. | 26\u00a0minutes ago\n \n Description : MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Trans...", "creation_timestamp": "2026-07-29T21:21:23.968372Z"}]}