{"vulnerability": "cve-2026-5286", "sightings": [{"uuid": "81c823a4-c825-4f6e-a54c-df7324a76fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5286", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mifzak4oci22", "content": "", "creation_timestamp": "2026-04-01T06:00:29.736413Z"}, {"uuid": "bdd88dbc-9f84-492c-8089-737ec8c53dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5286", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116327922216539438", "content": "", "creation_timestamp": "2026-04-01T06:00:29.792324Z"}, {"uuid": "69cd9c84-8683-48e1-8eb9-49084770c893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116328050981830981", "content": "", "creation_timestamp": "2026-04-01T06:33:12.488573Z"}, {"uuid": "c6da85f0-8f1a-4a60-b0da-1c3e94b571fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3migasws5bo2n", "content": "", "creation_timestamp": "2026-04-01T08:16:06.355060Z"}, {"uuid": "44f3894a-fc70-4844-ae37-3d5b5e9dc3b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116329798400742227", "content": "", "creation_timestamp": "2026-04-01T13:57:35.925218Z"}, {"uuid": "0faeebb3-49b3-408c-bb72-72f1117db1b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3migwwlz3nx2d", "content": "", "creation_timestamp": "2026-04-01T14:51:48.567158Z"}, {"uuid": "0f1bf9ef-4798-40c3-b601-6ce88cf489fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3migykxs2mu25", "content": "", "creation_timestamp": "2026-04-01T15:21:05.774901Z"}, {"uuid": "d661f336-8ab3-4473-a6ff-7dc369e3eac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0385/", "content": "", "creation_timestamp": "2026-03-31T17:00:00.000000Z"}, {"uuid": "1ab2a976-0294-4397-bc0f-65e7f02b7057", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260402", "content": "", "creation_timestamp": "2026-04-01T18:00:00.000000Z"}, {"uuid": "519974be-7c49-4a01-9c52-3527bf73ce81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0392/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "e174555d-049b-46e1-ad9d-97d5e077a6dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mj7hg4vguk2v", "content": "", "creation_timestamp": "2026-04-11T08:50:44.898752Z"}, {"uuid": "50cbbc09-1f2c-4230-87d1-7e8b03f0ea32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260413", "content": "", "creation_timestamp": "2026-04-12T20:00:00.000000Z"}, {"uuid": "ebd04a47-91a6-4897-909a-f7b532459321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "https://www.thezdi.com/blog/2026/4/14/the-april-2026-security-update-review", "content": "", "creation_timestamp": "2026-04-14T15:49:19.000000Z"}, {"uuid": "19ce82ba-c199-4b60-b472-f772db1d1ca6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5286", "type": "seen", "source": "Telegram/4u6pNJfi3nLv5HBYbkAV_RO5hA7CasKnKFj2guWNAP2iZfQ", "content": "", "creation_timestamp": "2026-04-01T15:25:59.000000Z"}, {"uuid": "a8de4d54-9185-4d68-a402-708002a1ef9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52866", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-169-01", "content": "", "creation_timestamp": "2026-06-18T05:00:00.000000Z"}, {"uuid": "7f16ba41-2ac3-4e11-9735-22c9bec878b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52866", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3molmxpdsxc2g", "content": "~Cisa~\nVulnerabilities in Apollo Pharmacy Blood Glucose Monitors allow BLE interception of health data and DoS attacks.\n-\nIOCs: CVE-2026-50034, CVE-2026-52866\n-\n#CVE202650034 #CVE202652866 #ThreatIntel", "creation_timestamp": "2026-06-18T20:07:56.522640Z"}, {"uuid": "81e65821-e763-4c71-b98a-3876c90d4650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52868", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpk3fqjp4i2z", "content": "CVE-2026-52868 - OFFIS DCMTK Toolkit Path Traversal\nCVE ID : CVE-2026-52868\n \n Published : June 30, 2026, 9:06 p.m. | 39\u00a0minutes ago\n \n Description : An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a ...", "creation_timestamp": "2026-06-30T22:46:11.579243Z"}, {"uuid": "19748888-3bb2-4b0a-9815-5e77956fd27b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52868", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01", "content": "", "creation_timestamp": "2026-07-01T02:36:51.493647Z"}, {"uuid": "f23c92d1-b413-4907-9406-899bee934303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52865", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqp6emfm6t2m", "content": "CVE-2026-52865 - NGINX Ingress Controller vulnerability\nCVE ID : CVE-2026-52865\n \n Published : July 15, 2026, 2:33 p.m. | 43\u00a0minutes ago\n \n Description : When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permis...", "creation_timestamp": "2026-07-15T16:47:45.347249Z"}, {"uuid": "de669a82-7cb0-4638-abaa-794dc9e65b08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52865", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mqrc4ik4ie2t", "content": "\ud83d\udd17 CVE : CVE-2026-42533, CVE-2026-46333, CVE-2026-52865, CVE-2026-55723, CVE-2026-56434, CVE-2026-59762, CVE-2026-60005, CVE-2026-60062, CVE-2026-60065", "creation_timestamp": "2026-07-16T13:00:07.417432Z"}, {"uuid": "60b5afb3-9ac8-4d14-a03e-45640281a8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52869", "type": "seen", "source": "https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb", "content": "# CVE-2026-52869: CVE-2026-52869: Session Hijacking and Authorization Bypass in Model Context Protocol (MCP) Python SDK\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52869\n\n## Summary\nAn authorization bypass vulnerability exists in the Model Context Protocol (MCP) Python SDK prior to version 1.27.2. The Server-Sent Events (SSE) and stateful Streamable HTTP transports route incoming JSON-RPC requests based purely on user-controlled session identifiers without validating ownership, enabling authenticated attackers to inject commands into other sessions.\n\n## TL;DR\nThe MCP Python SDK failed to bind active session identifiers to authenticated client principals, allowing any bearer-token-authenticated user to hijack and inject JSON-RPC messages into another client's session by supplying their session ID.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS Score**: 7.1 (High)\n- **Exploit Status**: poc\n- **Impact**: Authorization Bypass, Hijacking\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol (MCP) Python SDK (mcp PyPI package)\n- **mcp (PyPI)**: < 1.27.2 (Fixed in: `1.27.2`)\n\n## Mitigation\n\n- Upgrade Python mcp SDK to 1.27.2 or higher.\n- Configure custom authentication middleware to populate subject, client_id, and issuer claims.\n- Restrict trace and network logs to prevent exposure of active session UUIDs.\n\n**Remediation Steps:**\n1. Verify current package version via 'pip show mcp'.\n2. Execute 'pip install --upgrade mcp' to pull down 1.27.2+.\n3. Audit custom Starlette middleware implementations for compatibility with AuthenticatedUser constructs.\n4. Ensure experimental task management APIs use session-scoped generated IDs instead of global static task IDs.\n\n## References\n\n- [CVE-2026-52869 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-52869)\n- [GitHub Security Advisory GHSA-jpw9-pfvf-9f58](https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58)\n- [Official Release v1.27.2](https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52869) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-16T20:31:08.551113Z"}, {"uuid": "f7fbded5-2b9c-42a5-b8f3-b22288b3b324", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52865", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqw7svhp5q2x", "content": "CVE-2026-52865 [MEDIUM] nginx\n\nWhen NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Cont\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-52865", "creation_timestamp": "2026-07-18T12:02:16.481316Z"}, {"uuid": "36f4d294-1d5a-4ca2-b64f-842d2921ce8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52863", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mraktg4bem2i", "content": "CVE-2026-52863 - Memory corruption could lead to crash and denial of service\nCVE ID : CVE-2026-52863\n \n Published : July 22, 2026, 1:09 p.m. | 36\u00a0minutes ago\n \n Description : In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' mod...", "creation_timestamp": "2026-07-22T14:46:02.509429Z"}]}