GHSA-qvqr-5cv7-wh35 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
SummaryThe Ruby SDK's [streamable_http_transport.rb](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb) implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data.Details**Root Cause**
The StreamableHTTPTransport implementation stores only one SSE stream object per session ID and lacks:Session-to-user identity bindingOwnership validation when establishing SSE connectionsProtection against multiple simultaneous connections to the same sessionPoCVulnerable Code**File**: streamable_http_transport.rb - [L336-L339](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L336-L339):Attack Scenario**Step 1**: Legitimate Session EstablishmentStep 2: Session ID CompromiseAn attacker obtains the session ID through various means (out of scope for this analysis)**Step 3**: Stream Hijacking**Step 4**: Data InterceptionALL subsequent tool responses/notifications go to the attackerThe legitimate user receives no data and has no indication of the hijackingTechnical DetailsThe vulnerability happens:**Client 1 connects (GET request)****Client 2 connects with SAME session ID (Attack!)****Now when the server sends notifications:****Comparison: Python SDK Protection**The Python SDK prevents this vulnerability by rejecting duplicate SSE connections:**Refer**: https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685When a duplicate connection attempt is detected, the Python SDK returns an HTTP 409 Conflict error, protecting the existing connection.**Recommended Mitigations**
**For SDK Maintainers**Implement User Binding: All SDKs should bind session IDs to authenticated user identities where possible. Currently only, go-sdk and csharp-sdk do user binding.**Ruby SDK**: Prevent Duplicate Connections: Implement checks to reject or handle multiple simultaneous connections to the same session**Improve Documentation**: Provide clear guidance on secure session management implementation for SDK consumersSteps To Reproduce:Please find attached two python client files demonstrating the attack**Terminal 1:**
`ruby streamable_http_server.rb`Makes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
This server has a tool call notification_tool which the clients call**Terminal 2:**`python3 legitimate_client_ruby_server.py`**What happens:**The client connects and prints the session IDPress Enter to start the SSE streamNotifications start appearing every 3 seconds as the client makes a tool call**Terminal 3 (while the legitimate client is running):**`python3 attacker_client_ruby_server.py <SESSION_ID>`Replace `<SESSION_ID>` with the ID from Terminal 2.**What happens immediately:**Terminal 2 (Legitimate): Stops receiving notifications, shows disconnect messageTerminal 3 (Attacker): Starts receiving ALL the tool call responsesImpactWhile the absence of user binding may not pose immediate risks if session IDs are not used to store sensitive data or state, the fundamental purpose of session IDs is to maintain stateful connections. If the SDK or its consumers utilize session IDs for sensitive operations without proper user binding controls, this creates a potential security vulnerability. For example: In the case of the Ruby SDK, the attacker was able to hijack the stream and receive all the tool responses belonging to the victim. The tool responses can be sensitive confidential data.Additional DetailsSession Hijacking Protection in MCP ImplementationsThe MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".Current Implementation Status Across SDKsOf the 10 official MCP SDKs, only the following implementations bind session IDs to user-specific information:csharp-sdk - https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L93-L97Go-sdk - https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2[attacker_client_ruby_server.py](https://github.com/user-attachments/files/25408485/attacker_client_ruby_server.py)
[legitimate_client_ruby_server.py](https://github.com/user-attachments/files/25408486/legitimate_client_ruby_server.py)
The remaining SDKs do not implement session-to-user binding. Most implementations only verify that a session ID exists, without validating ownership. Additionally, SDK documentation does not provide clear guidance on implementing secure session management, leaving security responsibilities unclear for SDK consumers.
CVSS v4.0 score: 8.2