MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data. Version 0.9.2 contains a patch.

Affected: RubyGems: mcp

### Summary

The Ruby SDK's [streamable_http_transport.rb](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb) implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data.

### Details **Root Cause** The StreamableHTTPTransport implementation stores only one SSE stream object per session ID and lacks:

- Session-to-user identity binding - Ownership validation when establishing SSE connections - Protection against multiple simultaneous connections to the same session

### PoC

#### Vulnerable Code

**File**: streamable_http_transport.rb - [L336-L339](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb#L336-L339):

``` def store_stream_for_session(session_id, stream) @mutex.synchronize do if @sessions[session_id] @sessions[session_id][:stream] = stream # OVERWRITES existing stream else stream.close end end end ``` #### Attack Scenario **Step 1**: Legitimate Session Establishment ``` POST / (initialize) → receives session_id: "abc123" GET / with Mcp-Session-Id: abc123 → SSE stream connected ``` Step 2: Session ID Compromise

- An attacker obtains the session ID through various means (out of scope for this analysis)

**Step 3**: Stream Hijacking

``` GET / with Mcp-Session-Id: abc123 @se…