How severe is GHSA-5p9g-j988-pcwv?

No CVSS score has been assigned to GHSA-5p9g-j988-pcwv yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-5p9g-j988-pcwv?

GHSA-5p9g-j988-pcwv affects the following packages: mcp (RubyGems). Ecosystems affected: RubyGems.

How do I fix GHSA-5p9g-j988-pcwv?

Update mcp to 0.23.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5p9g-j988-pcwv is resolved across your whole dependency graph.

How do I detect GHSA-5p9g-j988-pcwv in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mcp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-5p9g-j988-pcwv if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-5p9g-j988-pcwv?

O3 pinpoints whether GHSA-5p9g-j988-pcwv is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-5p9g-j988-pcwv actively exploited in the wild?

No public exploit code has been indexed for GHSA-5p9g-j988-pcwv yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is GHSA-5p9g-j988-pcwv?

GHSA-5p9g-j988-pcwv is classified as CWE-284 (CWE-284). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was GHSA-5p9g-j988-pcwv published, and has it been updated?

GHSA-5p9g-j988-pcwv was published on July 30, 2026 and was last updated on July 30, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎 RubyGems

GHSA-5p9g-j988-pcwv

GHSA-5p9g-j988-pcwv is a CWE-284 vulnerability in mcp. O3 Security confirms whether GHSA-5p9g-j988-pcwv is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

MCP Ruby SDK: Ruby SSE Session Poisoning

Also known asCVE-2026-67431

Published

Jul 30, 2026

Updated

Jul 30, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Blast Radius

1 pkg affected

💎mcp

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim

Details

https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L260-L278

Victim starts a legitimate MCP session and receives session ID abc-123 Attacker obtains the session ID (various means - network sniffing, logs, etc. out of scope for this analysis) Attacker sends POST to /messages/abc-123 with a tool call Server accepts the request (no ownership validation!) Server executes the tool and sends response to victim's SSE stream Victim receives attacker's response, thinking it's legitimate

PoC

attacker_client.py legitimate_client.py

Prerequisites

Python 3.8+
Install dependencies: requests

Running the Demo

Terminal 1: Start the Ruby MCP Server

ruby streamable_http_server.rb

Makes use of https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb This server has a tool call notification_tool which the clients call

Terminal 2: Start Victim Client

python3 legitimate_client.py

Terminal 3 - Attacker Client:

Copy the session ID from Terminal 1 and run:

python3 attacker_client.py abc-123-def-456

Back to Terminal 2 - Victim sees the injected response:

Impact

Integrity: HIGH - Attacker can execute unauthorized tools and modify state
Availability: LOW - Attacker can disrupt victim's session with injected responses

Additional Details

Session Hijacking Protection in MCP Implementations

The MCP specification recommends - "MCP servers SHOULD bind session IDs to user-specific information".

User Binding - Comparison other SDKs

csharp-sdk

Go-sdk

Comparison with the Stream Replacement vulnerability

Stream Replacement https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35

Target: SSE stream connection
Attack Vector: GET /mcp
What happens to Victim: The connection is disconnected and doesn't receive reponses

Session Poisoning

Target: Tool execution
Attack Vector: POST /mcp
What happens to Victim: The connection stays connected and receives responses of tool calls by attacker

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`mcp`	all versions	0.23.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for mcp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update mcp to 0.23.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5p9g-j988-pcwv is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-5p9g-j988-pcwv is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-5p9g-j988-pcwv. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary **Vulnerability**: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for unauthorized actions, but it is hard to know for the victim ### Details https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L260-L278 **Victim** starts a legitimate MCP session and receives session ID abc-123 **Attacker** obtains th

O3 Security · Impact-Aware SCA

Is GHSA-5p9g-j988-pcwv in your dependencies?

O3 detects GHSA-5p9g-j988-pcwv across RubyGems dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works