CVE-2026-33946: lfprojects mcp_ruby_sdk Session Fixation

Vulnerability summary

CVE-2026-33946 is a high (CVSS 8.2) Session Fixation vulnerability in lfprojects mcp_ruby_sdk. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-03-2026
   PublishedVulnerability first disclosed.
2. 30-03-2026
   Last modifiedVulnerability information updated.

Description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.