CVE-2026-55604 (GCVE-0-2026-55604)

Vulnerability from cvelistv5 – Published: 2026-07-09 21:13 – Updated: 2026-07-10 14:42

Title

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

Summary

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 14:40 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/arikusi/deepseek-mcp-server/se…	x_refsource_CONFIRM
https://github.com/arikusi/deepseek-mcp-server/re…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
arikusi	deepseek-mcp-server	Affected: >= 1.4.2, < 1.7.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T14:40:34.870840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T14:42:09.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "deepseek-mcp-server",
          "vendor": "arikusi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.2, \u003c 1.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T21:13:15.713Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
        },
        {
          "name": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fh3r-g96v-f578",
        "discovery": "UNKNOWN"
      },
      "title": "@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55604",
    "datePublished": "2026-07-09T21:13:15.713Z",
    "dateReserved": "2026-06-16T23:31:22.445Z",
    "dateUpdated": "2026-07-10T14:42:09.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55604",
      "date": "2026-11-01",
      "epss": "0.00372",
      "percentile": "0.31208"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "deepseek-mcp-server",
                "vendor": "arikusi",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.4.2, \u003c 1.7.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch."
          },
          {
            "lang": "es",
            "value": "DeepSeek MCP Server es un servidor MCP para DeepSeek V4. A partir de la versi\u00f3n 1.4.2 y antes de la versi\u00f3n 1.7.0, el \u2019SessionStore\u2019 global del proceso acepta valores de \u2019session_id\u2019 proporcionados por el llamador sin vincularlos a ning\u00fan principal autenticado o sesi\u00f3n de transporte. Un atacante puede enumerar IDs de sesi\u00f3n activas a trav\u00e9s de \u2019deepseek_sessions\u2019, luego reutilizar un \u2019session_id\u2019 controlado por la v\u00edctima en \u2019deepseek_chat\u2019 para recuperar y continuar el contexto de conversaci\u00f3n de la v\u00edctima. La versi\u00f3n 1.7.0 contiene un parche."
          }
        ],
        "id": "CVE-2026-55604",
        "lastModified": "2026-10-25T17:10:00.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55604",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T14:40:34.870840Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-09T22:17:06.247",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55604",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-10T14:40:34.870840Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-10T14:39:10.996Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "deepseek-mcp-server",
              "vendor": "arikusi",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.4.2, \u003c 1.7.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-09T21:13:15.713Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
            },
            {
              "name": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0"
            }
          ],
          "source": {
            "advisory": "GHSA-fh3r-g96v-f578",
            "discovery": "UNKNOWN"
          },
          "title": "@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55604",
        "datePublished": "2026-07-09T21:13:15.713Z",
        "dateReserved": "2026-06-16T23:31:22.445Z",
        "dateUpdated": "2026-07-09T21:13:15.713Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55604

Vulnerability from fkie_nvd - Published: 2026-07-09 22:17 - Updated: 2026-10-25 17:10

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0
	security-advisories@github.com	https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "deepseek-mcp-server",
          "vendor": "arikusi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.4.2, \u003c 1.7.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context. Version 1.7.0 contains a patch."
    },
    {
      "lang": "es",
      "value": "DeepSeek MCP Server es un servidor MCP para DeepSeek V4. A partir de la versi\u00f3n 1.4.2 y antes de la versi\u00f3n 1.7.0, el \u2019SessionStore\u2019 global del proceso acepta valores de \u2019session_id\u2019 proporcionados por el llamador sin vincularlos a ning\u00fan principal autenticado o sesi\u00f3n de transporte. Un atacante puede enumerar IDs de sesi\u00f3n activas a trav\u00e9s de \u2019deepseek_sessions\u2019, luego reutilizar un \u2019session_id\u2019 controlado por la v\u00edctima en \u2019deepseek_chat\u2019 para recuperar y continuar el contexto de conversaci\u00f3n de la v\u00edctima. La versi\u00f3n 1.7.0 contiene un parche."
    }
  ],
  "id": "CVE-2026-55604",
  "lastModified": "2026-10-25T17:10:00.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55604",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-10T14:40:34.870840Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-09T22:17:06.247",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FH3R-G96V-F578

Vulnerability from github – Published: 2026-08-25 18:37 – Updated: 2026-08-25 18:37

Summary

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

Details

Cross-Session Data Exposure via Caller-Controlled `session_id`

Project / Repository: arikusi/deepseek-mcp-server
Affected version / commit tested: 1.6.0 / 04f28be2c6e99d3d4e443a6ae37cc35f0a71554a
Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No

Summary

The process-global SessionStore accepts caller-supplied session_id values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via deepseek_sessions, then reuse a victim-controlled session_id in deepseek_chat to retrieve and continue the victim's conversation context.

Affected Code

src/session.ts:42 - caller-controlled session IDs are looked up directly from the global in-memory map.
src/session.ts:67 - a new session is stored under the caller-controlled ID without ownership binding.
src/session.ts:109 - getMessages() retrieves messages for any supplied session ID.
src/tools/deepseek-chat.ts:195 - deepseek_chat creates or reuses the supplied session_id.
src/tools/deepseek-chat.ts:197 - previous messages are loaded from the supplied session_id.
src/tools/deepseek-chat.ts:198 - previous messages are prepended into the attacker-controlled request.
src/tools/deepseek-chat.ts:243 - attacker-provided user messages are appended into the reused session.
src/tools/deepseek-chat.ts:245 - assistant responses are appended back into the reused session.
src/tools/deepseek-sessions.ts:37 - deepseek_sessions list enumerates all active sessions.
src/tools/deepseek-sessions.ts:53 - each enumerated session ID is rendered back to the caller.

PoC Overview

Create a victim conversation with session_id = "victim-session".
Call deepseek_sessions with action = "list" and observe that victim-session is disclosed.
Call deepseek_chat again with session_id = "victim-session" from a separate attacker flow.
The upstream request now includes the victim's prior messages before the attacker's message.

Validation Environment

Local runtime verification on Windows host with Node.js v24.11.1, using the repository code at the tested commit and a local mock DeepSeek client to capture the effective message list passed upstream.

Impact

Any reachable caller can enumerate active session IDs and read prior conversation history stored in memory for other callers within the same server process. The same flaw also allows attacker-controlled continuation of another user's session state.

Remediation

Bind stored sessions to an authenticated transport session or other server-generated opaque identifier.
Do not allow arbitrary user-supplied session_id values to select existing server-side state.
Remove or restrict deepseek_sessions list so it does not disclose unrelated session IDs.
Reject reuse of a session unless the caller proves ownership of that session.

Attached Evidence

01_deepseek-mcp-server_cross_session_data_exposure.txt

Patches (maintainer)

Fixed in 1.7.0. The HTTP transport's SessionStore is no longer a process-wide singleton: each MCP HTTP session gets its own store, injected into the deepseek_chat and deepseek_sessions tool handlers, so a session_id from one HTTP session cannot read, enumerate, or clear another session's state. STDIO transport was never affected (one process per client). Integration tests in src/transport-isolation.test.ts assert the isolation.

Affected versions >=1.4.2, <1.7.0 are deprecated on npm. Upgrade to 1.7.0 or later.

Workaround

If upgrading is not immediately possible, run in STDIO transport (unset TRANSPORT=http) or stop the HTTP server.

Credit

Reported independently by @232-323 and @2REBCat (tested against 1.6.0). The same root cause was found and fixed concurrently by the maintainer during a security audit, shipped in 1.7.0. All parties are credited as finders.

Note on severity

A connected client could read other clients' conversation history (C:H), inject messages into their sessions (I:L), and clear or delete other clients' sessions (A:L). Scope is unchanged: the impact stays within the application's own authorization boundary, which is a cross-tenant authorization bypass, so S:U is correct.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@arikusi/deepseek-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.2"
            },
            {
              "fixed": "1.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55604"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T18:37:27Z",
    "nvd_published_at": "2026-07-09T22:17:06Z",
    "severity": "HIGH"
  },
  "details": "# Cross-Session Data Exposure via Caller-Controlled `session_id`\n\nProject / Repository: `arikusi/deepseek-mcp-server`  \nAffected version / commit tested: `1.6.0` / `04f28be2c6e99d3d4e443a6ae37cc35f0a71554a`  \nVulnerability type: Authorization bypass / cross-session data exposure \nAuthentication required: No\n\n## Summary\nThe process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim\u0027s conversation context.\n\n## Affected Code\n- `src/session.ts:42` - caller-controlled session IDs are looked up directly from the global in-memory map.\n- `src/session.ts:67` - a new session is stored under the caller-controlled ID without ownership binding.\n- `src/session.ts:109` - `getMessages()` retrieves messages for any supplied session ID.\n- `src/tools/deepseek-chat.ts:195` - `deepseek_chat` creates or reuses the supplied `session_id`.\n- `src/tools/deepseek-chat.ts:197` - previous messages are loaded from the supplied `session_id`.\n- `src/tools/deepseek-chat.ts:198` - previous messages are prepended into the attacker-controlled request.\n- `src/tools/deepseek-chat.ts:243` - attacker-provided user messages are appended into the reused session.\n- `src/tools/deepseek-chat.ts:245` - assistant responses are appended back into the reused session.\n- `src/tools/deepseek-sessions.ts:37` - `deepseek_sessions list` enumerates all active sessions.\n- `src/tools/deepseek-sessions.ts:53` - each enumerated session ID is rendered back to the caller.\n\n## PoC Overview\n1. Create a victim conversation with `session_id = \"victim-session\"`.\n2. Call `deepseek_sessions` with `action = \"list\"` and observe that `victim-session` is disclosed.\n3. Call `deepseek_chat` again with `session_id = \"victim-session\"` from a separate attacker flow.\n4. The upstream request now includes the victim\u0027s prior messages before the attacker\u0027s message.\n\n## Validation Environment\nLocal runtime verification on Windows host with Node.js `v24.11.1`, using the repository code at the tested commit and a local mock DeepSeek client to capture the effective message list passed upstream.\n\n## Impact\nAny reachable caller can enumerate active session IDs and read prior conversation history stored in memory for other callers within the same server process. The same flaw also allows attacker-controlled continuation of another user\u0027s session state.\n\n## Remediation\n- Bind stored sessions to an authenticated transport session or other server-generated opaque identifier.\n- Do not allow arbitrary user-supplied `session_id` values to select existing server-side state.\n- Remove or restrict `deepseek_sessions list` so it does not disclose unrelated session IDs.\n- Reject reuse of a session unless the caller proves ownership of that session.\n\n## Attached Evidence\n[01_deepseek-mcp-server_cross_session_data_exposure.txt](https://github.com/user-attachments/files/26991248/01_deepseek-mcp-server_cross_session_data_exposure.txt)\n\n---\n\n## Patches (maintainer)\n\nFixed in **1.7.0**. The HTTP transport\u0027s `SessionStore` is no longer a process-wide singleton: each MCP HTTP session gets its own store, injected into the `deepseek_chat` and `deepseek_sessions` tool handlers, so a `session_id` from one HTTP session cannot read, enumerate, or clear another session\u0027s state. STDIO transport was never affected (one process per client). Integration tests in `src/transport-isolation.test.ts` assert the isolation.\n\nAffected versions `\u003e=1.4.2, \u003c1.7.0` are deprecated on npm. Upgrade to 1.7.0 or later.\n\n## Workaround\n\nIf upgrading is not immediately possible, run in STDIO transport (unset `TRANSPORT=http`) or stop the HTTP server.\n\n## Credit\n\nReported independently by @232-323 and @2REBCat (tested against 1.6.0). The same root cause was found and fixed concurrently by the maintainer during a security audit, shipped in 1.7.0. All parties are credited as finders.\n\n## Note on severity\n\nA connected client could read other clients\u0027 conversation history (C:H), inject messages into their sessions (I:L), and clear or delete other clients\u0027 sessions (A:L). Scope is unchanged: the impact stays within the application\u0027s own authorization boundary, which is a cross-tenant authorization bypass, so S:U is correct.",
  "id": "GHSA-fh3r-g96v-f578",
  "modified": "2026-08-25T18:37:27Z",
  "published": "2026-08-25T18:37:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/arikusi/deepseek-mcp-server/security/advisories/GHSA-fh3r-g96v-f578"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55604"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/arikusi/deepseek-mcp-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/arikusi/deepseek-mcp-server/releases/tag/v1.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55604 (GCVE-0-2026-55604)

FKIE_CVE-2026-55604

GHSA-FH3R-G96V-F578

Cross-Session Data Exposure via Caller-Controlled session_id

Summary

Affected Code

PoC Overview

Validation Environment

Impact

Remediation

Attached Evidence

Patches (maintainer)

Workaround

Credit

Note on severity

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Cross-Session Data Exposure via Caller-Controlled `session_id`