MCP Python SDK Vulnerability: Experimental Task Handlers Allow Unauthorized Access to Tasks
A high-severity vulnerability (CVE-2026-52870) exists in the MCP Python SDK, specifically in the experimental tasks feature. When enabled, default request handlers do not check session ownership, allowing any client to access and cancel other clients' tasks. Affected versions are from 1.23.0 to 1.27.1. The vulnerability has a CVSS v3 score of 7.6 and is classified under CWE-862 (Missing Authorization).