8.2
High
CVE-2026-33946 MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-sdk 0.9 | earliest → < 0.9.2 | 0.9.2 |
Other CVEs of ruby-sdk
The 6 CVEs of ruby-sdk →
CVE-2026-67432
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
7.5
High
CVE-2026-67431
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
8.3
High
CVE-2026-63119
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
6.2
Medium
CVE-2026-67430
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients
5.3
Medium