VULNERABILITY INTELLIGENCE
CVE-2026-33946
CVSS score5.9 MEDIUM
EPSS probability0.47%
CISA KEVNot currently listed
Published2026-03-27
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
Weakness classification
- security-advisories@github.com: CWE-384
- nvd@nist.gov: CWE-384
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Product, Release Notes
- security-advisories@github.com — Exploit, Vendor Advisory
- security-advisories@github.com — Permissions Required
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory