Vulnerability DatabaseCVE-2026-33946
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-33946
March 27, 2026
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
Affected Packages
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk.git (GITHUB):
Affected version(s) >=v0.1.0 <v0.9.2
Fix Suggestion:
Update to version v0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
mcp (RUBY):
Affected version(s) >=0.0.1 <0.9.2
Fix Suggestion:
Update to version 0.9.2
Related Resources (9)
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685
https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L93-L97
https://hackerone.com/reports/3556146
https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2
https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35
https://github.com/modelcontextprotocol/ruby-sdk/commit/db40143402d65b4fb6923cec42d2d72cb89b3874
https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.9.2
https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
https://github.com/modelcontextprotocol/ruby-sdk
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Authorization Bypass Through User-Controlled Key
CWE-639
Session Fixation
CWE-384
EPSS
Base Score:
0.05