Security Advisory

CVE-2026-79537 : Cross-tenant session hijack in metatool-ai/metamcp

Severity

High

CVSS 3.1

8.7

Published

September 22, 2026

Back to advisories

Table of Contents

Advisory details

Product:

MetaMCP (github.com/metatool-ai/metamcp)

Affected versions:

v2.4.22 and ai-dev commit ff4ff2d

Patched version:

CVSS 3.1 vector:

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE:

CWE-639 Authorization Bypass Through User-Controlled Key; CWE-306 Missing Authentication for a Critical Function

Publication status:

Pending publication on CVE.org

Summary

MetaMCP routes traffic by an unchecked session ID and leaks live IDs from an open health endpoint. An attacker may be able to access another tenant's namespace.

Where the bug is

Session store: session-lifetime-manager.ts, getSession, keyed only by session ID
Transport dispatch: routers/public-metamcp/streamable-http.ts, the SSE /message variant, and routers/mcp-proxy/metamcp.ts
Authorization middleware: api-key-oauth.middleware.ts, which validates the URL endpoint's owner only
Unauthenticated disclosure: GET /metamcp/health/sessions, which returns live session IDs and the namespaces they are connected to

How it works

Each MCP session is bound at creation to the namespace and request context of the tenant that created it. On dispatch, the handler looks the session up by the session-id header the client sends and forwards the request to that session's transport. It never checks that the session belongs to the URL endpoint, the namespace, or the caller. The authorization middleware only checks that the caller may use the endpoint in the URL. So a caller using their own endpoint, or an endpoint with authentication turned off, passes the check and is then dispatched into the victim's namespace.

Session IDs are random, but the unauthenticated health endpoint exposes active session IDs and namespace identifiers. Exploitation requires a valid, active victim session ID; the unauthenticated health endpoint may disclose such IDs.

The cross-tenant access was reproduced in a controlled deployment, including a variant that needs no credentials at all against an endpoint with authentication disabled. No third-party host was tested.

Impact

An attacker can list and call another tenant's private MCP tools and read that tenant's data, using the victim's forwarded upstream credentials. Depending on what the victim has connected, that means reading files, reading or writing databases, or acting against SaaS accounts as the victim. The damage stays at the tool and data layer; it is not host compromise.

How to fix it

No patched release had been identified as of September 22, 2026. Treat this as an operational risk:

Until a patch is available, restrict public access and limit deployments to trusted networks.
Require authentication on the session-listing health endpoint, and remove raw session and namespace IDs from its response.
Do not run endpoints with authentication disabled on a reachable network.
For a code fix: bind each session to its owning endpoint and namespace when it is created, and before dispatch verify that the stored owner matches the URL endpoint and the caller's authorized scope. Treat the session-id header as untrusted input.